Hook
In a single September patch batch, Ivanti disclosed ten CVEs across three product lines. Two scored CVSS 9.8. One โ an authentication bypass in Sentry โ needed no credentials, no interaction, and no privileged network position. Remote. Unauthenticated. Administrator-level access, one request. The same month, Microsoft shipped an identity-layer fix in Patch Tuesday. SAP's OVERPASS flaw, a CVSS 10.0, had already been flagged by Mandiant as among the most exploited vulnerabilities of the prior year.
Crypto did not blink.
That silence is the story. Between the disclosure and the next conference keynote, an exchange's infrastructure team quietly pushed a patch to the mobile devices its staff use to approve transfers. No thread. No spaces. Data leaves footprints; hype leaves only dust. The off-chain backbone that holds every on-chain promise together was bleeding, and almost nobody in Web3 noticed.
Context โ The Machine Under the Machine
Ivanti is not a household name. It does not need to be. The company sells the software enterprises use to manage everything else: mobile device management (MDM/EMM), IT service management (ITSM), and the mobile traffic gateway that routes device sessions into the corporate backend. Three of its products now matter to anyone who claims to care about crypto custody.
Sentry is a mobile traffic proxy. It sits between employee devices and the enterprise systems behind them. EPMM โ Endpoint Manager Mobile โ manages the lifecycle of the fleet: configuration, patch policy, device enrollment, remote wipe. Neurons for ITSM is the workflow brain, the ticketing and change-management layer that decides what gets deployed, approved, and recorded.
Read that stack again. It is a control plane. Whoever owns it owns everything it governs.
For a decade the crypto industry has told itself a comfortable fable: the risk lives in the smart contract. You audit the Solidity, you verify the bytecode, you watch the chain. Everything else is "operations," a euphemism for the unglamorous work nobody funds a conference panel for. But the exchanges, custodians, node operators, and funds that hold real capital are enterprises now. They run MDM. They run ITSM. They run SSO and the same mobile gateways everyone else does. The chain is trustless. The company that signs the transactions is not.
This is where the September disclosures land. And this is where the crypto audience should start paying attention.
Core โ The Teardown
Start with Sentry, CVE-2026-83527, CVSS 8.1.
The technical class is CWE-288 โ authentication bypass using an alternate path or channel. Translation: the login exists, but there is a route around it. The exploit is fully remote, needs no credentials, and requires no user interaction. Affected versions run from Sentry R10.6.4 through R10.8.2, patched forward. Success condition: complete administrator access to the gateway.
Why that matters is architectural, not just numeric. Sentry is a traffic broker. It proxies mobile devices into corporate backends. Take its admin seat and you do not merely read one device's traffic โ you stand inside the pipe that carries every device's traffic. For a crypto firm, that pipe can include the laptops approving treasury movements, the phones receiving withdrawal confirmations, the tablet that runs the custody dashboard. One unauthenticated request, and the boundary device becomes a listening post.
Next: EPMM, CVE-2026-18851, CVSS 8.8.
This is CWE-862 โ missing authorization. The pre-condition is heavier: an attacker needs an initial authenticated foothold. But the outcome is a vertical climb to full administrator. Affected branches run below 12.10.0.0, 12.9.0.2, and 12.8.0.4. Once inside, the attacker commands fleet configuration, patch policy, and the complete mobile device management surface.
Label this one a post-authentication privilege escalation. That label hides its danger. The right way to read CVE-2026-18851 is as an amplifier: it takes a small intrusion โ one infected device, one compromised low-privilege employee account โ and turns it into total command of the fleet. In crypto terms, it converts a phished analyst into the operator of every device that touches the signing process.
Then the pair that should have made headlines: CVE-2026-12744 and CVE-2026-12745, both CVSS 9.8, both in Neurons for ITSM.
The class is deserialization of untrusted data, yielding pre-authentication remote code execution. This is not a permissions problem. This is code execution on the service itself, before login. Two 9.8s in the same product in the same batch is not noise. It is a statement about engineering discipline. Deserialization sits on the OWASP Top Ten for a reason: it is a known, named, well-documented failure mode, and mature teams have had a decade to stop writing it.
For a crypto operation, Neurons for ITSM is the change-management brain. It schedules maintenance, approves deployments, logs incidents, and issues the work orders technicians trust. Compromise it and you can forge the paper trail that backs a real attack. You can insert a "routine" configuration change. You can rewrite the incident record after the fact. You can plant patch guidance that installs the attacker's payload while wearing the uniform of legitimate change control. Beneath every whitepaper lies a buried intent โ here, the intent lives in a forged ticket, and it arrives pre-approved.
Now look at the historical spine, because this is the part the marketing pages omit.
CVE-2023-38035, CVSS 9.8, was an authentication bypass in the Sentry API. It was actively exploited in 2023 and added to CISA's Known Exploited Vulnerabilities catalog. Three years later, CVE-2026-10523, CVSS 9.9, was another Sentry authentication bypass โ this one allowing an unauthenticated attacker to create arbitrary administrator accounts. In January 2026, CVE-2026-1281, CVSS 9.8, was an unauthenticated remote code execution in EPMM, exploited as a zero-day. By May 2026, CVE-2026-6973, a post-authentication RCE in the same product, was being chained against credentials leaked during the January zero-day.
That is a three-year, same-family pattern. Two authentication bypasses in one product, a 9.9 in another cycle, a zero-day, then a chained escalation using the credentials the zero-day spilled. This is not bad luck. This is what a systemic gap in the security development lifecycle looks like from the outside. When the same class of bug returns to the same product on a schedule, you are not watching an accident. You are watching a process.
Here is the cascade that should alarm any crypto operator who runs this stack. Sentry guards the mobile access boundary. EPMM manages the device fleet. Neurons for ITSM orchestrates the change process. An attacker who chains them moves edge, then device control, then process forgery. Break the gateway, harvest the management credentials. Use those credentials to escalate inside EPMM, then push a malicious configuration to every enrolled device. Then reach inside ITSM and manufacture the change record that makes the intrusion look routine.
The two CVSS 9.8 pre-authentication RCEs and the two authentication bypasses arrived in the same patch window. That is not statistical coincidence. That is every key on one ring.
Crypto's equivalent stack looks structurally identical, and that is the point. A serious exchange's operational security is a chain of tiers: hardware security module, key management service, signing service, deployment pipeline, and the identity layer above all of them. The key management service does not exist in a vacuum. It runs on a fleet. The fleet is managed. The build pipeline is governed by change tickets. The identities that reach the signing service are issued and enforced by the same SSO and MDM infrastructure the rest of the enterprise uses. If the management plane falls, the keys are only as private as the fleet that guards them. "Not your keys, not your coins" is a fine slogan until the key server runs on a managed device whose patch policy an attacker just rewrote.
In 2022, I ran a static analysis against a Layer-2 bridge that raised twelve million dollars. I found an integer overflow in the withdrawal path the team had deferred because the deadline was tight. I disclosed it on GitHub and forced a pause on mainnet launch. That episode taught me something the audit reports leave out: the contract was defensible within a week. The vulnerability that nearly sank it lived in the process around the code. The same logic applies here, one tier down. The chain is not where the next crypto loss is seeded. The management plane is.
A code risk assessment, in the register this industry reserves for audits it commissioned itself: the distribution across the September batch โ two 9.8 pre-auth RCEs, one 8.8 post-auth privilege escalation, one 8.1 no-credential bypass โ reads as one thing. An authentication and authorization architecture spot-fixed for years rather than rebuilt. The correct interpretation is not "replace the vendor." The correct interpretation is that identity logic at the management layer is a strategic liability, and crypto operations inherit that liability the moment they adopt the tooling.
I no longer call anything autonomous or decentralized without a full enumeration of its off-chain dependencies. I started writing that rule after tearing down three "autonomous agent" protocols that turned out to be cron jobs pointed at centralized APIs. The discipline extends here. A custody stack is only as decentralized as its least-audited dependency, and right now the least-audited dependency is the software that manages the laptops.
The industry context sharpens instead of softening the point. PaperCut and N-able โ lightweight applications that manage other tools, deployed fast by IT admins with default settings โ belong to the same danger class. Microsoft carried an authentication gap into a cloud identity service in the same September patch window. SAP's OVERPASS, CVSS 10.0, was labelled by Mandiant among 2025's most exploited. Core ERP, print management, endpoint management, and now identity itself. The phase has shifted. Attackers have stopped knocking on the perimeter and started targeting the consoles that hold power over everything behind them.
Pair that with exposure windows and the crypto reading becomes unavoidable. CVE-2026-83527, the Sentry bypass, closes only once every instance reaches 10.6.4 or later; until then it is a zero-credential door. CVE-2026-18851 closes at 12.8.0.4 and above, but its real threat is the amplifier function layered onto credentials that already leaked. The Neurons for ITSM deserialization pair closes only with the vendor's fix pack, and a 9.8 pre-auth RCE has never waited patiently for a maintenance window. Public proof-of-concept for a bug this well documented tends to appear within days of a patch diff, not weeks. For a crypto operator, the priority order writes itself: the two RCEs first, the no-credential gateway bypass second, the privilege amplifier third โ and all three before the next treasury operation.
Audits check syntax; journalists check motive. The motive here is visible in the pattern. Every cycle, the fixes are surgical. Every cycle, the same class returns. Code is law only until someone finds the loophole โ and the loophole keeps reappearing in the same module.
Contrarian โ What the Bulls Got Right
There is a fair case on the other side, and it deserves to be stated without sneering.
The crypto security community has actually been ahead here. Bounty culture, public post-mortems, on-chain forensics, and an adversarial default posture have produced a discipline traditional enterprise software vendors rarely match. When a crypto protocol loses funds, the community dissects the transaction in the open within hours. Ivanti's customers, by contrast, often learn the scope of their exposure from a press cycle. That instinct โ treat everything as hostile until proven otherwise โ is exactly the instinct that catches a management-plane cascade before it becomes a loss.
Where the bulls go wrong is in where they aim it. The obsession with smart-contract auditing has crowded out the control plane. A firm will pay six figures to have a Solidity module reviewed line by line and then deploy the resulting change ticket through an ITSM instance running two CVSS 9.8s. The rigor is real. It is simply pointed at the wrong layer. The chain was never the weak part. The company around it was.
So credit the culture and correct the aim. Truth is not distributed; it is discovered โ and the discovery here is that crypto's adversarial DNA positions it better than a bank to defend the management plane, if it ever redirects its attention there.
Takeaway
The question for the next twelve months is not which chain is most decentralized. It is who audits the management plane. Not the auditors who read bytecode โ the ones who read architecture, permissions, and change control before a single line of contract code is deployed. Until custody is treated as an operating-system problem rather than a token problem, the keys will be exactly as safe as the gateway that never logged out.