CVE-2026-12745

CVE-2026-12745 is a deserialization of untrusted data flaw (CWE-502) in Ivanti Neurons for ITSM, the vendor's enterprise IT service management platform. A remote, unauthenticated attacker can send crafted serialized data to a vulnerable instance over the network, which the server deserializes without validation. Successful exploitation results in arbitrary code execution on the server, with critical confidentiality, integrity, and availability impact (CVSS 3.1: 9.8). All deployments of Neurons for ITSM before version 2026.2 are affected, including instances published to the internet for self-service access. As of this analysis there is no known exploitation and no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns a 2.1% probability of exploitation within 30 days (81st percentile).

What to do: Upgrade Ivanti Neurons for ITSM to version 2026.2 or later. Until patched, restrict network exposure of the ITSM server (especially any self-service portals reachable from the internet) and monitor for anomalous traffic, prioritizing patching of internet-facing instances first since no authentication is required.