CVE-2026-12650

Think of Ivanti Neurons for ITSM as your building’s reception desk that processes requests. This vulnerability lets a logged-in attacker send a “fake request package” that the server mistakenly treats as safe and, instead, runs attacker-chosen commands on the server. In practical terms, that can mean attackers gain control of the ITSM server, not just access to a single page or account.

This matters if you run Ivanti Neurons for ITSM and have users who can authenticate (even with limited privileges). The risk applies to deployments on versions before 2026.2.

Reachability details aren’t confirmed in the findings, but the vulnerability requires the attacker to already be authenticated—so it’s mainly a concern if an attacker could obtain credentials or if a user account is compromised.

This is RED because it allows arbitrary code execution on the server, which can lead directly to full system compromise and service disruption. The attacker only needs low-privilege, valid credentials, and there is mounting press attention tied to this issue.

1. Confirm exposure

   • Identify the exact “neurons for itsm” version currently deployed.
   • If the version is earlier than 2026.2, you are in the vulnerable range described by the findings.

2. Patch (primary action)

   • Upgrade Ivanti Neurons for ITSM to 2026.2.
   • If you have multiple environments (test/staging/production), upgrade non-production first to validate behavior, then roll out to production.

3. Validate after upgrading

   • Re-check the installed version is now 2026.2.
   • Monitor the application for errors during/after the upgrade and confirm core ITSM functions still work.

4. If you cannot patch immediately (temporary containment)

   • Limit network access to Ivanti Neurons for ITSM to trusted admin networks and known management IP ranges.
   • Reduce the number of accounts that have the ability to authenticate to the Neurons interface to the minimum necessary.
   • Treat any signs of account compromise (unexpected logins, new/changed users, unusual session activity) as incident-level events until patched.

5. What to monitor

   • Authentication logs for unusual or repeated failed/successful logins.
   • Admin actions and changes within the application around the same timeframe as suspicious logins.
   • Server logs for unexpected process execution or command activity originating from the application service context.

CISA KEV

• This CVE is not listed in CISA KEV per the findings.

Severity is critical: the vulnerability enables arbitrary code execution on the server with the privileges of the application (CWE-502: deserialization of untrusted data). The attack requires remote network access and valid authenticated credentials with low privileges; user interaction is not required. Ivanti Neurons for ITSM is affected only for versions before 2026.2, and the fixed version is 2026.2.

Exploitation status

• CISA KEV listing: not listed.
• Public exploit code: none on record in the findings.
• Press reports: no clear dated exploitation claim provided.
• However, the overall verdict for this CVE is RED, driven by the impact (arbitrary code execution) and rising attention.

Attack mechanism (high level)

• A remote, authenticated attacker submits maliciously crafted data that the application deserializes/handles unsafely, resulting in execution of attacker-controlled commands on the server.