CVE-2026-12645: Critical severity Ivanti Neurons for ITSM vulnerability
Published Sep 8, 2026
·Updated
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
Affected Software
1 affected component
Ivanti Neurons for ITSM<2026.2
Event History
Sep 8, 2026
CVE Published
via MITRE·02:38 PM
Data Sourced
via MITRE·02:38 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this vulnerability?
A remote attacker who is authenticated to Ivanti Neurons for ITSM can exploit it. No user interaction is required.
2
What is the impact of successful exploitation?
Successful exploitation allows arbitrary code execution on the server, with high impact to confidentiality, integrity, and availability.
3
Which versions need remediation?
Ivanti Neurons for ITSM versions before 2026.2 are affected. Upgrading to 2026.2 or later addresses the affected-version condition described.