CVE-2026-12744: Ivanti Neurons For Itsm

Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days.

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.

Affected products

• Ivanti Neurons For Itsm: version 2025.2 only; version 2025.3 only; version 2025.4 only; version 2026.1 only; version 2026.2 only

Published 2026-09-08. Last modified 2026-09-18.