External risk intelligence

Ivanti Neurons for ITSM Deserialization Vulnerability Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-12744

Ivanti Neurons for ITSM is a centralized enterprise management and service platform typically deployed as a public-facing web service or API to support remote users and external service interactions, making it highly likely to be reachable from the internet by design.

Deserialization

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Ivanti Neurons for ITSM could allow an unauthenticated attacker to execute arbitrary code on the server. This issue stems from the deserialization of untrusted data, meaning that if the system processes data from an unreliable source without proper checks, it could be tricked into running malicious commands. While the specific business impact depends on how this system is used within your organization, vulnerabilities of this nature on a central platform warrant attention to confirm relevance and exposure.

Untrusted data can lead to server code execution.
Central management platforms require vigilant oversight.
Confirm if this system is in use and exposed.

Attack Path

How an attacker could exploit the issue

A remote attacker can exploit this vulnerability by sending specially crafted data to the Ivanti Neurons for ITSM server, which processes it without proper validation. This leads to the execution of arbitrary code on the server, potentially compromising the entire system.

No authentication or user interaction required.
Sending malicious serialized data to the server.
Arbitrary code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM could allow an unauthenticated remote attacker to execute arbitrary code on the server. This could impact the integrity and availability of the affected system.

Server-side code execution.
Via network without authentication.
System compromise and data loss.

Operational Fix

Recommended remediation, mitigation, and detection steps

Addressing this critical vulnerability in Ivanti Neurons for ITSM requires a coordinated effort, likely involving application owners who manage the ITSM instance, infrastructure teams supporting the underlying servers, and potentially network or security teams responsible for external access. The immediate priority is to locate all deployed instances of Ivanti Neurons for ITSM, confirm their exposure to the internet, assess business criticality, and identify the specific teams or individuals accountable for each instance to plan a risk-based remediation strategy.

Application owners must own the issue.
Verify instance internet reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Ivanti Neurons for ITSM?

Ivanti Neurons for ITSM is a centralized enterprise platform that helps organizations manage IT services, workflows, and infrastructure. It acts as a primary hub for handling support requests and service delivery, often integrating with other business applications to facilitate automated task management and tracking for IT teams.

How does this Deserialization of Untrusted Data vulnerability work?

This vulnerability, classified as CWE-502, occurs when the software takes data from an outside source and converts it into an object without verifying its content. If an attacker sends specially crafted, malicious data, the server may mistakenly process it as legitimate instructions. Because the system trusts this input, it ends up executing unauthorized code, granting the attacker control over the server environment.

Do I need to be logged into the system for an attack to happen?

No. The vulnerability allows an unauthenticated attacker to trigger the issue remotely. This means no valid user account or interaction with the system is required to initiate the exploit. As long as the server is reachable and configured to process the specific types of data affected by this flaw, it can be targeted.

Is my instance at risk if it is connected to the internet?

Yes, your risk is elevated. According to Halo Surface Signal, Ivanti Neurons for ITSM is typically designed as a public-facing web service or API to support remote users and external integrations. Because it is often reachable from the internet by design, an external attacker can reach the vulnerable component directly without needing prior access to your internal network.

When should I prioritize fixing this CVE-2026-12744 flaw?

You should prioritize this immediately. Begin by identifying all deployed instances of Ivanti Neurons for ITSM within your environment and verifying their internet exposure. Engage your application owners and infrastructure teams to assess the criticality of these systems, establish accountability, and plan a remediation strategy to secure the affected instances.

References

hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-M…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.