This vulnerability (CVE-2026-12645) in Ivanti Neurons for ITSM is classified as CWE-862 (Missing Authorization). It allows a remote attacker with valid authentication privileges to execute arbitrary code on the server, potentially leading to full system compromise. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. The vendor has not yet provided an official fix or remediation details, and affected versions are not explicitly identified beyond being prior to 2026.2.

Successful exploitation enables remote authenticated attackers to execute arbitrary code on the server, resulting in full compromise of confidentiality, integrity, and availability of the affected system. This could lead to unauthorized data access, modification, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Ivanti Neurons for ITSM server to trusted users only and monitor for suspicious activity. Do not rely on generic mitigations as the vendor has not provided specific recommendations.