CVE-2026-12648

Ivanti Neurons for ITSM versions before 2026.2 contain a deserialization of untrusted data flaw (CWE-502) that lets an attacker execute arbitrary code on the server. The flaw is triggered when the application deserializes attacker-controlled data, and it can be exploited remotely by any authenticated user with low-level privileges, without user interaction. Successful exploitation yields code execution with high impact on confidentiality, integrity and availability (CVSS 3.1: 8.8). Only organizations running vulnerable, self-hosted or on-prem instances of Ivanti Neurons for ITSM are affected; Ivanti's fixed release is 2026.2. Exploitation has not been observed in the wild, no public proof-of-concept is known, and the flaw is not yet in CISA's KEV catalog, with EPSS estimating a modest ~1.5% chance of exploitation in the next 30 days.

What to do: Upgrade Ivanti Neurons for ITSM to release 2026.2 or later. Because exploitation requires valid low-privilege credentials, limit the application's exposure to the internet where possible, review accounts for unnecessary access, and check authentication and application logs for unusual activity from authenticated users.