CVE-2026-12745
CriticalCVSS 9.8Summary
A deserialization of untrusted data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.
Risk Assessment
An unauthenticated attacker could execute arbitrary code on the server, potentially leading to full system compromise and data breach.
Recommendation
Immediately upgrade Ivanti Neurons for ITSM to version 2026.2 or later and restrict system access.
Other vulnerabilities in Ivanti Neurons for ITSM
See all- CVE-2026-12651High
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
- CVE-2026-12648High
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
- CVE-2026-12744Critical
A deserialization of untrusted data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.
- CVE-2026-12650Critical
A deserialization of untrusted data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
- CVE-2026-12647Critical
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
- CVE-2026-12646Critical
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
- CVE-2026-12645Critical
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
- CVE-2026-9614High
An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative access.
Original NVD description (English source)
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.