CVE-2026-12646: Ivanti Neurons For Itsm

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

Affected products

• Ivanti Neurons For Itsm: version 2025.2 only; version 2025.3 only; version 2025.4 only; version 2026.1 only; version 2026.2 only

Published 2026-09-08. Last modified 2026-09-18.