CVE-2026-12646: ivanti neurons_for_itsm

CVSS 9.9 (critical) · published 2026-09-08

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

Affected products (NVD): ivanti neurons_for_itsm

Weakness: CWE-862

Source: NVD CVE-2026-12646

References

• https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-Multiple-CVEs?language=en_US

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.