CVE-2026-12647: Critical severity Ivanti Neurons for ITSM vulnerability
Published Sep 8, 2026
·Updated
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
Affected Software
1 affected component
Ivanti Neurons for ITSM<2026.2
Event History
Sep 8, 2026
CVE Published
via MITRE·02:43 PM
Data Sourced
via MITRE·02:43 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this vulnerability?
A remote attacker must be authenticated to the Ivanti Neurons for ITSM instance. No user interaction is required.
2
What is the potential impact of successful exploitation?
An authenticated attacker can execute arbitrary code on the server. The supplied severity vector indicates high impact to confidentiality, integrity, and availability, with impact extending beyond the vulnerable security authority.
3
Which deployments need remediation?
Ivanti Neurons for ITSM versions before 2026.2 are affected. Upgrade to version 2026.2 or later.