This vulnerability (CWE-502) in Ivanti Neurons for ITSM arises from improper handling of deserialization of untrusted data, enabling remote unauthenticated attackers to execute arbitrary code on the server. The vulnerability affects versions prior to 2026.2. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary code on the server running Ivanti Neurons for ITSM, potentially leading to full system compromise, data theft, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected service and monitor for suspicious activity related to deserialization attempts.