CVE-2026-12745 – Ivanti Neurons for ITSM
“Two of these flaws need no login at all. They turn your IT service desk into a door attackers can open from anywhere.”
Ivanti Neurons for ITSM 2026.2 fixes eight vulnerabilities that let remote attackers run arbitrary code on the server. Every flaw affects versions before 2026.2. CVE-2026-12744 and CVE-2026-12745 are unsafe deserialization flaws that an unauthenticated attacker can exploit. Each has a CVSS score of 9.8, Critical severity. CVE-2026-12650 is a deserialization flaw that needs an authenticated attacker. It has a CVSS score of 9.9, Critical severity. CVE-2026-12648 and CVE-2026-12651 are the same type of flaw. Each has a CVSS score of 8.8, High severity.
CVE-2026-12645, CVE-2026-12646, and CVE-2026-12647 are missing authorization flaws that let an authenticated attacker escalate privileges and run code on the server. Each has a CVSS score of 9.9, Critical severity. The service desk platform holds sensitive asset, user, and workflow data, so a compromise reaches deep into the organization. Upgrade to Ivanti Neurons for ITSM 2026.2 the same day.
Key Details
- Affected Product
- Ivanti Neurons For Itsm
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-502