This vulnerability (CVE-2026-4913) in Ivanti Neurons for ITSM (On-Premise) arises from improper protection of an alternate access path. Specifically, a remote attacker with valid authentication can continue to access the system after their user account has been disabled, due to failure in enforcing account disablement on this alternate path. The CVSS 3.1 base score is 5.7 (medium), reflecting network attack vector, low attack complexity, required privileges, and user interaction, with high confidentiality impact but no integrity or availability impact. The vulnerability affects versions before 2025.4, but no patch or official remediation guidance is currently available.

An attacker with valid credentials can maintain unauthorized access to the Ivanti Neurons for ITSM system even after their account is disabled, potentially exposing sensitive information (high confidentiality impact). There is no impact on system integrity or availability. This could undermine access control policies and user deprovisioning processes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should carefully monitor and audit user access, and consider additional compensating controls to detect and prevent unauthorized access via alternate paths. No official remediation level or patch has been published by Ivanti at this time.