Critical· 9.8official fix available
CVE-2026-12745
A critical vulnerability in Ivanti Neurons for ITSM allows attackers to run arbitrary code on the server without authentication. The flaw is due to unsafe deserialization of untrusted data.
publishedSep 8, 2026
last modifiedSep 18, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
2%
81th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Oct 8, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
Ivanti Neurons for ITSM users running any version prior to 2026.2.
02
Real-world impact
An attacker could take full control of the affected server, potentially compromising all data and services managed by the ITSM system.
03
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited remotely with no authentication, and the impact is complete compromise of confidentiality, integrity, and availability.
04
What to do about it
official fix available
recommended steps
- 01Upgrade Ivanti Neurons for ITSM to version 2026.2 or later.
- 02Restart the Neurons service to apply the update.
NVD description
05
Timeline
- Sep 8, 2026 · 16d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 8, 2026 · 16d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Sep 18, 2026 · 6d agoAdvisory updatedThe NVD record was last revised.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
References & advisories
- hub.ivanti.com/s/article/Security-Advisory…vendor advisory
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →