CVE-2026-12650: CWE-502 Deserialization of untrusted data in Ivanti Neurons for ITSM

This vulnerability (CWE-502) in Ivanti Neurons for ITSM involves unsafe deserialization of untrusted data, which can be exploited by a remote authenticated attacker to execute arbitrary code on the affected server. The flaw affects versions prior to 2026.2 and requires authentication but no user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required, no user interaction, and complete compromise of confidentiality, integrity, and availability.

Successful exploitation allows remote authenticated attackers to execute arbitrary code on the server hosting Ivanti Neurons for ITSM, potentially leading to full system compromise including data theft, modification, or service disruption.

A fix is available in Ivanti Neurons for ITSM version 2026.2. Users should upgrade to version 2026.2 or later to remediate this vulnerability. No additional mitigation guidance is provided in the vendor advisory; patching is the recommended action.