This vulnerability (CVE-2026-12651) is classified as CWE-502: Deserialization of Untrusted Data in Ivanti Neurons for ITSM. It allows a remote attacker with authentication privileges to execute arbitrary code on the server by exploiting unsafe deserialization processes. The CVSS 3.1 score of 8.8 reflects that the attack vector is network-based with low complexity, requiring privileges but no user interaction, and results in high impact on confidentiality, integrity, and availability. The vulnerability affects versions before 2026.2, but no vendor advisory or patch information is currently available to confirm remediation status.

Successful exploitation enables remote authenticated attackers to execute arbitrary code on the server hosting Ivanti Neurons for ITSM. This compromises the confidentiality, integrity, and availability of the affected system, potentially leading to full system compromise or disruption of IT service management operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit access to the affected system to trusted users only and monitor for suspicious activity. Avoid exposing the management interface to untrusted networks. Follow Ivanti's official channels for updates on patches or mitigations.