Ivanti Fixes Two CVSS 9.9 Flaws in Neurons Patch for Intune and Xtraction That Leak Credentials
Do Son 
TL;DR
Ivanti published two advisories on October 13, 2026, covering six flaws in Neurons Patch for Intune and Xtraction. Two are Ivanti critical vulnerabilities rated CVSS 9.9, and both can expose sensitive credentials. Ivanti reports no exploitation so far.
Why It Matters
Both products connect to other enterprise systems. As a result, stolen secrets could open doors well beyond the flawed app itself. One flaw touches Microsoft Entra ID credentials, while another exposes EPMM connector credentials. That makes credential theft the main risk in this release.
How the Attacks Work
Neurons Patch for Intune (CVE-2026-109412)
This cloud service exposed a dangerous endpoint. According to the Neurons Patch for Intune advisory, it “allows a remote authenticated attacker to leak sensitive authentication information.”
Xtraction (five CVEs)
The most serious Xtraction bug, CVE-2026-106042 (CVSS 9.9), lets an authenticated attacker redirect app requests to their own server. That attacker can then “obtain EPMM connector credentials transmitted by the application.” The other four flaws include:
- CVE-2026-106047 (CVSS 7.7): a path traversal bug that lets authenticated users read arbitrary files.
- CVE-2026-106043 (CVSS 7.5): a missing authentication flaw that lets unauthenticated attackers create or modify a trusted site.
- CVE-2026-106034 and CVE-2026-106035: medium flaws covering directory changes and SQL password leaks in logs.
Exploitation status
For both products, Ivanti states: “We are not aware of any customers being exploited” at the time of disclosure. No public proof-of-concept has been confirmed.
Affected Versions
- Neurons Patch for Intune: cloud service, fixed for all environments on September 16, 2026
- Ivanti Xtraction: 2026.2.1 and prior
Patch and Mitigation Steps
- Update Xtraction to version 2026.4, available in Ivanti’s ILS portal.
- Rotate the Entra ID client secret used for Intune publication.
- Rotate EPMM connector credentials linked to Xtraction.
Intune customers need no update. Still, Ivanti advises: “Out of an abundance of caution, Ivanti recommends that customers rotate the client secret associated with the Microsoft Entra ID App Registration used for Intune publication.” Given these Ivanti critical vulnerabilities target credentials, rotating secrets is a smart move.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
