CVE-2026-12647

Undergoing Analysis Undergoing Analysis - In Progress

Missing Authorization in Ivanti Neurons for ITSM Allows Remote Code Execution

Publication date: 2026-09-08

Last updated on: 2026-09-18

Assigner: ivanti

Description

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-18

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-12647

Affected Vendors & Products

Vendor	Product	Version / Range
ivanti	neurons_for_itsm	2025.2
ivanti	neurons_for_itsm	2025.3
ivanti	neurons_for_itsm	2025.4
ivanti	neurons_for_itsm	2026.2
ivanti	neurons_for_itsm	2026.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This is a Missing Authorization vulnerability in Ivanti Neurons for ITSM before version 2026.2. It allows a remote attacker who is already authenticated to execute arbitrary code on the server without proper access controls.

Impact Analysis

An attacker could exploit this to gain full control over the affected server, leading to data theft, system disruption, or further network compromise. Since it requires authentication, attackers must first obtain valid credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations may face legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Update Ivanti Neurons for ITSM to version 2026.2 or later to address the missing authorization flaw. Ensure only authenticated users have access to the system and restrict remote access to trusted sources.

Hi! I’m here to help you understand CVE-2026-12647. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70