CVE-2026-12647

This is a security flaw in Ivanti Neurons for ITSM where, after an attacker successfully logs in (even with limited access), the normal permission checks can be bypassed. That could let them run harmful commands on the server—like planting malicious software or taking over the system. Think of it like an office door that still opens after a badge swipe, but then lets someone into rooms they shouldn’t reach.

This matters if your business uses Ivanti Neurons for ITSM and it’s running a version before 2026.2. The attacker still needs to be able to authenticate, but only with low privileges, and there’s no need for a user to click anything. Treat this as a risk when your Neurons for ITSM is reachable over the network from untrusted locations and an attacker can obtain valid credentials.

This is RED because the weakness can result in arbitrary code execution on the server, meaning attackers could directly compromise the system after gaining low-privilege access. The fix is available (2026.2), so you should prioritize upgrading immediately to eliminate the exposed authorization bypass path.

1. Confirm exposure

   • Identify the deployed Ivanti Neurons for ITSM version.
   • Determine whether it is before 2026.2 (the known fixed boundary in the available findings).

2. Upgrade to the fixed version

   • Upgrade Ivanti Neurons for ITSM to 2026.2.
   • Ensure the upgrade completed successfully and that the running application reports 2026.2 or later.
   • If you have multiple environments (prod/test/dev), prioritize production first.

3. Validate network reachability (reduce risk while patching)

   • If your Neurons for ITSM instance is reachable from the internet or from broad internal networks, restrict access to trusted IP ranges or a VPN/bastion where possible.
   • Confirm any remote management or API routes aren’t broadly exposed beyond what’s required.

4. Check for suspicious access patterns (especially low-privilege logins)

   • Review logs for successful logins by low-privileged accounts from remote IPs.
   • Look for unusual timing, new IPs, repeated failed attempts followed by success, or activity inconsistent with normal operations.
   • If you find anything suspicious, preserve logs and investigate for signs of command execution.

5. CISA/KEV status

   • This CVE is not listed in CISA KEV based on the provided findings, but it is still critical due to the impact described.

6. What to monitor after patching

   • Ongoing authentication activity (success/failure, source IPs, and account usage).
   • Any administrative actions or unexpected server-side changes that could indicate attempted abuse.

Severity is effectively critical due to the described outcome: authenticated remote arbitrary code execution on Ivanti Neurons for ITSM. The weakness is a missing authorization control (CWE-862), where an authenticated user with low privileges can bypass standard restrictions and perform unauthorized actions. The attack vector is network-based, and there is no user interaction required. The provided findings indicate preconditions of remote authenticated access with low privileges; default reachability is not confirmed in the findings. Exploitation status: KEV listing is not present, and no clear dated press claim or public exploit code is reported in the findings. A predicted likelihood (EPSS) is provided in the source set, but since KEV/news confirm exploitation were not found here, it is not used to drive public-facing guidance. Fix: Ivanti neurons for itsm is fixed in 2026.2.