CVE-2026-12646: CWE-862 Missing Authorization in Ivanti Ivanti Neurons for ITSM

This vulnerability (CWE-862) in Ivanti Neurons for ITSM prior to 2026.2 involves missing authorization checks that enable a remote attacker with valid authentication to execute arbitrary code on the affected server. The flaw allows an attacker to bypass access controls, leading to complete compromise of the system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges are low, no user interaction needed, and impacts confidentiality, integrity, and availability with high severity.

Successful exploitation results in full remote code execution on the server hosting Ivanti Neurons for ITSM, compromising confidentiality, integrity, and availability of the system. This can lead to complete system takeover by an attacker with remote authenticated access.

A fix is available in Ivanti Neurons for ITSM version 2026.2. Users should upgrade to version 2026.2 or later to remediate this vulnerability. No other mitigation guidance is provided. Patch status is confirmed by the vendor advisory indicating the fix is in version 2026.2.