This vulnerability (CVE-2026-12650) is classified as CWE-502: Deserialization of Untrusted Data in Ivanti Neurons for ITSM versions prior to 2026.2. It enables a remote attacker with authentication privileges to execute arbitrary code on the server by exploiting unsafe deserialization processes. The CVSS 3.1 score of 9.9 reflects its critical severity with network attack vector, low attack complexity, required privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. The vulnerability is published and assigned by Ivanti but lacks an official remediation level or patch information at this time.

Successful exploitation allows remote authenticated attackers to execute arbitrary code on the affected server, potentially leading to full system compromise, data loss, or service disruption. The vulnerability impacts confidentiality, integrity, and availability of the Ivanti Neurons for ITSM environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected system to trusted users only and monitor for suspicious activity related to deserialization processes. Avoid exposing the service to untrusted networks where possible.