CVE-2026-12645

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

Score

CVSS 3.1 9.9 Critical

Status

Analyzed - 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Published

2026-09-08

Last modified

2026-09-09

Weaknesses

CWE-862

Affected products

• Ivanti Neurons For Itsm (Ivanti)
• Neurons For Itsm (Ivanti)

References

• https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-Multiple-CVEs?language=en_US