CVE-2026-12646: Critical severity Ivanti Neurons for ITSM vulnerability

Q: Which versions should be treated as affected?

Ivanti Neurons for ITSM releases before 2026.2 are affected.

Q: Does an attacker need credentials to exploit this issue?

Yes. Exploitation requires remote authenticated access and is rated as requiring low privileges; no user interaction is required.

Q: What could an attacker do after successful exploitation?

A successful attacker can execute arbitrary code on the server, with high impact to confidentiality, integrity, and availability.

Published Sep 8, 2026

Updated

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

Affected Software

1 affected component

Ivanti Neurons for ITSM<2026.2

Event History

Sep 8, 2026

CVE Published

via MITRE·02:40 PM

Data Sourced

via MITRE·02:40 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which versions should be treated as affected?

Ivanti Neurons for ITSM releases before 2026.2 are affected.

Does an attacker need credentials to exploit this issue?

Yes. Exploitation requires remote authenticated access and is rated as requiring low privileges; no user interaction is required.

What could an attacker do after successful exploitation?