CVE-2026-12651: High severity Ivanti Neurons for ITSM vulnerability
Published Sep 8, 2026
·Updated
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
Affected Software
1 affected component
Ivanti Neurons for ITSM<2026.2
Event History
Sep 8, 2026
CVE Published
via MITRE·02:26 PM
Data Sourced
via MITRE·02:26 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
An attacker must be remotely authenticated to the affected Ivanti Neurons for ITSM instance. No user interaction is required.
2
What is the potential impact of successful exploitation?
A successful attacker can execute arbitrary code on the server. The supplied severity vector indicates high impact to confidentiality, integrity, and availability.
3
Which versions are affected?
Ivanti Neurons for ITSM versions before 2026.2 are affected. Updating to version 2026.2 or later addresses the affected version range described in the advisory.