New Vulnerabilities Patched in Ivanti Products October 2026

THREAT INTELLIGENCE

Peer Review

4.8

Proven Trust

Dark blue circle with two overlapping checkmarks, one green and one light blue.

ISO 27001 text with a globe outline symbol on a black background.

2025 winner badge for Cyber Security Excellence Awards with gold and black design.

Critical

CVE-2026-106042, CVE-2026-109412

Ivanti

October 13, 2026

Executive Summary

Six CVEs, including two CVSS 9.9 flaws: CVE-2026-106042 in Xtraction and CVE-2026-109412 in Neurons Patch for Intune.

Key Details

Affected Platform

Ivanti

Attack Surface

Recommended Action

Apply vendor patch

Affected Environment

Ivanti Xtraction 2026.2.1 and prior, and the Ivanti Neurons Patch for Intune cloud service.

Operational Impact

Credential theft, arbitrary file access, directory modification, and unauthorised actions on Ivanti reporting and patching systems.

Technical Root Cause

Path traversal, external control of file path, missing authentication, log exposure, and an exposed dangerous endpoint.

Recommended Mitigation

Upgrade Ivanti Xtraction to 2026.4 or later; confirm the Neurons Patch for Intune cloud update is applied.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Explore Managed Detection and Response

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

Ivanti Security Advisories.