Ivanti’s September 2026 security disclosures confirm a critical expansion of the authentication gap, moving beyond middleware and ERP systems directly into enterprise endpoint management. CVE-2026-83527 in Ivanti Sentry and CVE-2026-18851 in Endpoint Manager Mobile both involve missing or bypassed authentication before the system checks who is asking – the same structural failure that has run through PaperCut, N-able, Microsoft Patch Tuesday, and SAP’s kernel layer in the past six weeks.
CVE-2026-83527 is the more dangerous of the two. It carries a CVSS of 8.1 and is classified as CWE-288 – Authentication Bypass Using an Alternate Path or Channel. A remote attacker with no credentials and no victim interaction reaches a privileged administrative code path on the Sentry appliance. The flaw grants full administrative-level access over Sentry instances prior to R10.8.2, R10.7.3, and R10.6.4. Sentry brokers traffic between mobile devices and back-end enterprise systems; administrative access to Sentry means control over every device that routes through it.
CVE-2026-18851 in EPMM carries a CVSS of 8.8 and is classified as CWE-862 – Missing Authorization. It requires initial authenticated access but escalates to full administrator privileges, giving the attacker control over fleet configurations, patching policies, and mobile device management. The path is different from Sentry’s unauthenticated bypass, but the destination is the same: full administrative control over the management plane. EPMM versions prior to 12.10.0.0, 12.9.0.2, and 12.8.0.4 are affected.
The broader September batch covers 10 CVEs across EPMM, Sentry, and Neurons for ITSM. Neurons for ITSM received eight fixes, including CVE-2026-12744 and CVE-2026-12745 – both CVSS 9.8, both unauthenticated remote code execution via deserialization of untrusted data. That two CVSS 9.8 pre-auth RCEs sit alongside the Sentry and EPMM bypasses in the same patch cycle signals that the authentication gap is not a single-product problem. It runs across the entire Ivanti management stack.
Ivanti has stated that none of the September 2026 vulnerabilities were exploited in the wild prior to disclosure. This is preventive patching, not incident response – but Ivanti’s track record with these exact products makes the distinction thin. Ivanti Sentry was hit by CVE-2023-38035 (CVSS 9.8), an API authentication bypass on the Sentry Administrator Interface that was actively exploited and added to the CISA Known Exploited Vulnerabilities catalog in August 2023. CVE-2026-10523 followed – another Sentry authentication bypass (CVSS 9.9) that allowed unauthenticated creation of arbitrary administrative accounts, paired with CVE-2026-10520, an OS command injection companion. Two authentication bypasses in three years on the same product line.
EPMM’s history is equally compressed. CVE-2026-1281 was an unauthenticated RCE (CVSS 9.8) exploited as a zero-day in January 2026. CVE-2026-6973, a post-authentication RCE disclosed in May 2026, was chained with credentials previously compromised through the January zero-day – a credential-reuse attack made possible by the earlier authentication failure. The pattern across both products is not incidental. It reflects a structural weakness in how these management tools enforce identity checks.
The PaperCut and N-able incidents earlier this quarter hit the same class of vulnerability from a different direction – pre-authentication RCE chains in print management and remote monitoring tools. Microsoft’s September Patch Tuesday moved the gap into cloud-side identity services. SAP’s September Patch Day dropped four Critical CVEs – three authentication-related – with OVERPASS (CVSS 10.0) and S4GET (CVSS 9.8) bypassing authentication at the kernel level. The Mandiant M-Trends 2026 report named CVE-2025-31324, a pre-authentication SAP NetWeaver flaw, the most exploited vulnerability of 2025.
Ivanti’s disclosures bring the pattern to endpoint management – the layer that controls fleet configurations, patching policies, and device trust across the enterprise. When authentication fails in the tools that manage everything else, the blast radius is not a single application. It is every endpoint under management. The gap has moved from print servers to remote monitoring to ERP to identity services to mobile device management. The underlying failure – authentication bypassed or missing before the system evaluates who is asking – keeps recurring across different product categories and different vendors.