This vulnerability (CWE-862) in Ivanti Neurons for ITSM prior to 2026.2 involves missing authorization checks that permit a remote authenticated attacker to execute arbitrary code on the server. The CVSS 3.1 base score of 9.9 reflects network attack vector, low attack complexity, required privileges, no user interaction, and complete compromise of confidentiality, integrity, and availability. The vendor has published the vulnerability but has not yet released an official fix or provided remediation details. The affected versions are not explicitly stated but are described as versions before 2026.2.

Successful exploitation allows remote authenticated attackers to execute arbitrary code on the server, leading to full compromise of the affected system's confidentiality, integrity, and availability. This could result in unauthorized access, data breaches, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected Ivanti Neurons for ITSM instances to trusted users only and monitor for suspicious activity involving authenticated sessions.