External risk intelligence

Ivanti Neurons for ITSM Missing Authorization Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-12645

Ivanti Neurons for ITSM is a server-based IT service management platform frequently deployed as a web application accessible over the network. As an enterprise service portal, it is commonly exposed to internal or external users for service requests and management, placing it in a category of software typically reachable via standard web interfaces.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in Ivanti Neurons for ITSM that could allow an authenticated attacker to run unauthorized code on the server. This issue impacts the integrity and availability of the IT service management platform. The main concern is confirming relevance and exposure.

An attacker could run unauthorized code.
It affects a core IT management system.
Confirm if our systems are at risk.

Attack Path

How an attacker could exploit the issue

An attacker who can log in to Ivanti Neurons for ITSM could exploit a flaw in how the application checks user permissions. By sending a specially crafted request, the attacker could bypass these checks and execute commands on the server. This could allow them to take full control of the system.

Authenticated access to the application is required.
A specially crafted network request triggers the flaw.
Arbitrary code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

A missing authorization flaw in Ivanti Neurons for ITSM could allow a remote, authenticated attacker to execute arbitrary code on the server. This could affect the confidentiality, integrity, and availability of the affected system when supported by the advisory.

Server-side code execution.
Exploits authenticated access.
Compromises system integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

Identifying the correct team to address this critical vulnerability requires understanding your Ivanti Neurons for ITSM deployment. Typically, the platform or application owner is responsible for Ivanti Neurons for ITSM, with support from infrastructure and security teams for remediation and network access controls. The immediate first step is to determine the exact scope of affected instances, assess their business criticality and exposure, and then confirm ownership to plan the necessary remediation, potentially involving vendor coordination.

Platform/Application owners should manage remediation.
Verify affected instance reachability and criticality.
Coordinate with Ivanti for vendor patch deployment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Ivanti Neurons for ITSM?

Ivanti Neurons for ITSM is an enterprise IT service management platform. Organizations use it to automate service delivery, manage assets, and track workflows across their business. It functions as a central server-based application, often providing a web portal where users submit service requests and administrators manage complex IT infrastructure.

What does the Missing Authorization vulnerability mean for CVE-2026-12645?

This vulnerability is classified as CWE-862, which happens when software fails to verify if a user has permission to perform a specific action. In this case, the system does not properly check the rights of an authenticated user, allowing them to perform unauthorized actions, specifically executing arbitrary code on the server instead of being restricted to their assigned tasks.

How is CVE-2026-12645 triggered?

An attacker triggers this flaw by sending a specially crafted request to the server after successfully authenticating to the application. It is important to note that unauthorized, unauthenticated users cannot trigger this specific bug; the attacker must already possess valid login credentials to the platform to exploit the missing authorization check.

Do I need to worry about this if my instance is internal?

Halo Surface Signal indicates that because this platform is typically deployed as a web application, it is often reachable via standard network interfaces. While internet-facing instances are at higher risk, any deployment accessible over the network—even if internal—can potentially be reached by an authenticated attacker, making it important to assess the risk of your specific environment.

How should I respond to this vulnerability?

Your first step is to identify all instances of Ivanti Neurons for ITSM in your environment. Determine who owns each instance, assess their business criticality, and verify their current network reachability. Coordinate with your security and infrastructure teams to plan for the vendor-supplied patch deployment, ensuring all affected servers are updated according to the latest guidance from Ivanti.

References

hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-M…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.