The vulnerability is an exposed dangerous endpoint in Ivanti Neurons Patch for Intune that allows a remote authenticated attacker to retrieve sensitive authentication data. This flaw can result in the disclosure of credential material and other confidential authentication details, directly compromising the security of the affected environment. The weakness is identified as CWE-749, indicating that information from an untrusted source is improperly exposed.

The affected product is Ivanti Neurons Patch for Intune, operated by Ivanti. No specific version numbers are supplied, so all current installations of this product should be treated as vulnerable until a patch is applied.

The CVSS score of 9.9 indicates a critical severity. Exploitation requires the attacker to have remote authenticated access to the Neurons Patch service, but no additional privileges are required. Because the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, exploit availability in the wild has not yet been confirmed, yet the high CVSS remains a significant risk. The likely attack vector is remote network access to the vulnerable endpoint, and once compromised the attacker can read authentication information.