CVE-2026-12745

This flaw lets an attacker trick your Neurons for ITSM server into “reading” malicious data in a way that can cause it to run attacker-controlled code. Think of it like getting a package delivered with a hidden instruction inside—if your system is vulnerable, it may follow the instruction instead of treating it as harmless data.

This matters if you use Ivanti Neurons for ITSM (any version before 2026.2) to run your IT service management workflows. It’s most relevant when the Neurons for ITSM server can be contacted over the network, because the attacker does not need an account or user action. The key reachability gate is network exposure: this becomes a risk if the server is reachable from where an attacker can send network requests (and you’re running a version prior to 2026.2).

This is RED because the vulnerability is remote and unauthenticated, meaning an attacker can attempt it without logging in. Ivanti has released updates to fix multiple critical Neurons for ITSM issues in September 2026, including this one, so you should treat it as an urgent patching priority.

1. Confirm exposure and version

• Identify the exact Ivanti Neurons for ITSM version currently installed.
• Determine whether it is prior to 2026.2.

2. Validate network reachability

• Check whether your Neurons for ITSM server is reachable from the public internet (or from untrusted networks).
• Review firewall rules, reverse-proxy rules, and any port-forwarding that exposes Neurons for ITSM services.

3. Upgrade to the fixed version

• Upgrade Ivanti Neurons for ITSM to 2026.2.
• After upgrading, confirm the service starts correctly and that normal ITSM functions work.

4. If you cannot upgrade right away (temporary controls)

• Restrict access so the Neurons for ITSM server is not reachable from the public internet.
• Allow only known administrative IP ranges/VPN users (use your standard management path rather than direct exposure).

5. What to monitor after the change

• Review Neurons for ITSM logs and system logs for unusual inbound requests around the vulnerable service.
• Look for repeated failed requests or unexpected crashes/restarts that could indicate probing.

6. Expected timeline

• There is no KEV listing for this specific CVE in the provided findings.
• Because this is unauthenticated remote code execution and the fixed version is known (2026.2), remediation should be prioritized immediately within your patch window.

Severity is critical (RCE) with a weakness consistent with deserializing untrusted data (CWE-502). The mechanism described in the findings is that an attacker can send malicious network data to an Ivanti Neurons for ITSM server without authentication and without user interaction, leading to execution of arbitrary code on the server.

Exploitation status: KEV is not listed in CISA KEV, and no public exploit code is known. The provided press reporting does not include clear dated evidence of real-world exploitation for this specific CVE, but it states unauthenticated exploitability.

Fix: Ivanti has fixed this in neurons for itsm 2026.2.

EPSS note: a prediction is provided (2.1%) and is listed as flat, but this should not be treated as proof of exploitability; the findings emphasize unauthenticated remote attack capability and a known patch version.

What to take away: if you run a vulnerable Neurons for ITSM version and it is reachable over the network, the attacker can attempt RCE without logging in.