Vulnerabilities · 48 days ago
CSIRT Italia said N-able’s N-central flaw CVE-2026-86218 is being exploited in the wild, making the remote-management platform the immediate priority. N-able’s September fixes address three N-central vulnerabilities, while Ivanti also shipped patches the same day for Neurons for ITSM, Sentry, and Endpoint Manager Mobile.
CSIRT Italia says the N-central issue lets a remote attacker send crafted HTTP or HTTPS requests to an exposed server port, plant directives in files the server later trusts, and have those directives executed when the files are processed. In plain terms, the management console can be made to run attacker code, so the exposure is the control plane and everything it administers, not just the host running N-central.
That changes the reading for anyone running internet-facing management software: once the control layer is compromised, cleanup is not confined to a single box. Ivanti’s September fixes still matter, but this reporting puts N-able’s active incident ahead of scheduled patching for teams that manage fleets through these platforms.
CVEs in this update
6 CVEs
Across Neurons for ITSM, Ivanti Neurons for ITSM.
6 critical · 0 high · 0 medium · 0 low
0 in CISA KEV · 6 with EPSS above 1%
Highest severity: CVE-2026-12650 · 9.9 CRITICAL
Highest EPSS: CVE-2026-12744 · 2.9%
5 sources covering this story
Múltiples vulnerabilidades en productos de Ivanti
Ivanti ha publicado 10 vulnerabilidades: 6 de severidad crítica y 4 de severidad alta que, en caso de
Ivanti ha rilasciato aggiornamenti di sicurezza che sanano 10 vulnerabilità, di cui 6 con gravità "critica" e 4 con gravità "alta" in alcuni prodotti.
Kwetsbaarheid verholpen in Ivanti Endpoint Manager Mobile
Ivanti heeft een kwetsbaarheid verholpen in Ivanti Endpoint Manager Mobile.
Kwetsbaarheden verholpen in Ivanti Neurons for ITSM
Ivanti heeft meerdere kwetsbaarheden verholpen in Ivanti Neurons for ITSM.
Kwetsbaarheid verholpen in Ivanti Sentry
Ivanti heeft een kwetsbaarheid verholpen in Sentry versies voorafgaand aan R10.8.2, R10.7.3 en R10.6.4.
N-able: rilevato sfruttamento in rete della CVE-2026-86218 in N-central
Tra queste si segnala la CVE-2026-86218 che risulta essere attivamente sfruttata in rete.
Ivanti Patches Critical Flaws Across Enterprise Security Products
Six critical vulnerabilities in Neurons for ITSM could enable remote code execution, while Sentry and EPMM received patches for authentication bypass flaws.
September 2026 Security Update
For the month of September 2026, Ivanti is disclosing vulnerabilities in Ivanti Neurons for ITSM, Ivanti Endpoint Manager Mobile (EPMM) and Ivanti Sentry.
Part of the PlainSec briefing for 2026-09-11