Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-12646: Ivanti Neurons for ITSM lets logged‑in users run code
CVE-2026-12646 · published 1 month ago
Summary
A weakness in Ivanti Neurons for ITSM (versions before 2026.2) lets someone who has already logged in to the system execute any program on the server. This could let an attacker take control of the server and disrupt services. Apply the vendor’s update or patch as soon as possible and review user access rights.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ivanti | ivanti neurons for itsm | All versions |
| ivanti | neurons_for_itsm |
2025.2 2025.3 2025.4 2026.1 2026.2 cpe:2.3:a:ivanti:neurons_for_itsm:2025.2:*:*:*:*:*:*:* |
Original advisory text
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
References
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.8
High
Type
CWE-862Missing Authorization
Timeline
Published8 Sep 2026
Updated7 Oct 2026
First seen8 Sep 2026
Track software like this
Free during beta