This vulnerability (CVE-2026-12744) involves deserialization of untrusted data in Ivanti Neurons for ITSM versions prior to 2026.2. An attacker without authentication can exploit this flaw remotely to execute arbitrary code on the affected server. The issue is classified under CWE-502, which concerns unsafe deserialization practices that can lead to remote code execution. The vulnerability is publicly known and assigned a critical CVSS 3.1 score of 9.8, reflecting its high impact and ease of exploitation. No patch or official remediation level has been disclosed by Ivanti as of the publication date.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary code on the server running Ivanti Neurons for ITSM, compromising confidentiality, integrity, and availability of the system. This can lead to full system takeover, data breaches, and disruption of IT service management operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected service and monitor for suspicious activity related to deserialization attacks. Apply vendor updates promptly once available.