Ivanti's September Batch: Two 9.8 RCEs and the Management-Layer Trap Crypto Also Built

September's Ivanti patch batch landed with ten CVEs across three product lines. Two of them score 9.8 — pre-authentication remote code execution in Neurons for ITSM. One is a credential-free authentication bypass in Sentry. One is a post-auth privilege escalation in EPMM that hands an attacker the entire device fleet. No known wild exploitation. That is the only comforting line in the whole disclosure. I read this the way I read an on-chain exploit thread — data first, narrative never. And the data does not describe a bad month. It describes a management-layer collapse happening in public. Sentry, EPMM, Neurons for ITSM. That trio is not three products. It is one control plane split across three functions: traffic proxy, device management, IT service workflow. Break the proxy and you watch the traffic. Break the device manager and you own the fleet. Break the workflow engine and you can forge the change record that authorizes the next strike. Crypto runs the same topology. Custody stacks. Multi-sig admin consoles. Key-management dashboards. RPC gateways. Validator key stores. Every one is a "manage everything else" tool sitting in a privileged seat above the assets it guards. When the seat fails, the blast radius is not one application. It is every endpoint behind it. Ivanti is not a household name outside IT departments, which is exactly why the disclosure matters. Its stack sits underneath enterprise mobility. Sentry handles the proxy layer between mobile devices and backend systems. EPMM — Endpoint Manager Mobile — controls fleet configuration, patch policy, and the device lifecycle. Neurons for ITSM runs the service-management flow that approves changes and routes tickets. That is the definition of privileged infrastructure: software whose job is to manage the software and hardware everyone else depends on. Its failure mode is not a scaled version of an app breach. It is a keys-to-the-kingdom event. The September batch is not isolated. Follow the lineage. CVE-2023-38035 — a Sentry API authentication bypass, CVSS 9.8 — was actively exploited in August 2023 and landed in CISA's Known Exploited Vulnerabilities catalog. CVE-2026-10523 hit CVSS 9.9 in the same product line, allowing unauthenticated creation of arbitrary admin accounts. Then CVE-2026-1281, an EPMM unauthenticated RCE at 9.8, was exploited as a January 2026 zero-day. The credentials it leaked fed CVE-2026-6973, a post-auth RCE chained off the first break. Same product family. Same class of bug. Three years running. That is not bad luck. That is a structural defect in how authentication logic gets built, tested, and shipped. The phase we are in matters. Enterprise security has moved through three eras. First, attackers hit endpoint operating systems, and vendors hardened the endpoints. Then they hit firewall and VPN edges, and vendors hardened the perimeter. Now they hit the management tools themselves — the software with the privilege to administer everything else. It is the highest-leverage target in the stack, which is exactly why it is now the primary one. Start with CVE-2026-83527. Sentry. CVSS 8.1. CWE-288 — authentication bypass using an alternate path. Remote. No credentials. No user interaction. Affected versions run up to Sentry R10.8.2, R10.7.3, and R10.6.4. The payoff is full administrator access. Sit with that. Sentry is the proxy — everything routing between a mobile device and the corporate backend passes through it. Admin on Sentry means admin on the pipe carrying every managed device's traffic. You do not breach the devices. You breach the thing they trust to carry their data. In custody terms, this is like compromising the signing service that all your wallets call. Now CVE-2026-18851. EPMM. CVSS 8.8. CWE-862 — missing authorization. It needs an initial authenticated foothold, which is why it reads milder in a patch note. It is not mild. It escalates vertically to full admin, and full admin on EPMM means control over fleet configuration, patch policy, and the entire mobile device management plane. Affected versions sit below 12.10.0.0, 12.9.0.2, and 12.8.0.4. The threat model is the one analysts keep underrating: a single compromised low-privilege account — one infected handset, one leaked employee login — becomes a launchpad to rewrite the config of every device in the fleet. Post-auth bugs are the leveraged positions of vulnerability classes. A small entry position controls a large book. Then the two 9.8s. CVE-2026-12744 and CVE-2026-12745, both in Neurons for ITSM. Deserialization of untrusted data leading to pre-authentication RCE. No credentials. No interaction. Code executes on the service itself. Deserialization bugs are unglamorous and reliable, which is exactly what makes them dangerous. They are a decade-old entry on the OWASP Top 10, and they keep shipping because the fix requires touching foundational code rather than patching a surface. The fact that two of them appeared in the same product in the same cycle tells you review did not catch the pattern. A pre-auth deserialization RCE is also the kind of bug that gets stockpiled. Official "no known exploitation" statements reflect what a vendor can see in its own telemetry. They do not account for the APT that found the bug first, wrote a quiet exploit, and has every reason to keep it off the radar. That is a supply-chain-shaped risk, not a single-tenant one. Rank the three honestly. The Sentry and EPMM bugs are privilege-layer failures — you take the controls but operate through the product. The Neurons for ITSM double-9.8 is a service-layer failure — you execute directly. Analysts tend to rank by CVE headcount. I rank by where the code actually runs. The deserialization pair is the sharpest edge in the batch. Here is the angle the patch notes never print. The scariest thing in this disclosure is not any single CVE. It is that the three products form a trust cascade. Sentry guards the edge. EPMM manages the devices. Neurons for ITSM approves the changes. Chain them and an attacker walks from network edge to device control to forged workflow — the full vertical of enterprise mobility, stitched into one path. That is a crypto problem wearing an enterprise uniform. In Web3 the same cascade exists, and I have mapped it in my own audit work more times than I can count. A custody platform holds the keys. A multi-sig console holds the upgrade rights. A governance portal holds the process. The reason "code is law" keeps failing was never philosophical. The upgrade rights never lived in the code. They lived in the console above it — behind the same kind of authentication logic Ivanti just failed three times. That is the lesson worth extracting. When you audit a DeFi protocol or a custody stack, the smart contract is usually the part with the most eyes on it. The admin dashboard is the part with the thinnest review. Every time. The uncomfortable part for crypto is that this is not hypothetical. Bridges have been drained through admin-key compromises, not contract bugs. Governance decisions have been swung by a handful of wallets holding upgrade privileges. Every incident report says the same thing in different words: the audit covered the code, and the attacker went around it. Ivanti is the enterprise version of that same review gap, running at the scale of an entire IT department. Widen the lens and the pattern is industry-wide. PaperCut, N-able, Microsoft, SAP. SAP's OVERPASS scored a full 10.0, and CVE-2025-31324 was flagged by Mandiant as one of 2025's most-exploited bugs. The market keeps buying "zero trust" as a slogan while the management tools — the very things supposed to enforce trust — keep failing their own auth checks. If the identity service can be authenticated around, zero trust is a marketing deck, not an architecture. No wild exploitation yet. Do not confuse that with safety. The 72-hour window after a disclosure is when reverse engineers diff the patch, and a 9.8 pre-auth RCE usually has a weaponized proof of concept within days of a public writeup. Watch CISA's KEV catalog next — CVE-2023-38035 set the precedent, and a 9.9 predecessor already exists. The actionable part is version numbers. Sentry above R10.6.4. EPMM above 12.8.0.4. The Neurons for ITSM fix. If your stack touches any of them, the management layer is already the question — and it always was. For crypto teams, the operational takeaway mirrors the enterprise one. Inventory every console that sits above your contracts. Ask who can reach it, what auth it enforces, and whether that auth has ever been adversarially tested. The line you should be watching is not the CVE count. It is how much privilege you handed to the console nobody audited.