This vulnerability (CVE-2026-9614) in Ivanti Neurons for ITSM (On-Premises) is classified as CWE-284: Improper Access Control. It permits a remote attacker with valid authentication to escalate privileges and obtain administrative access. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has not yet released a patch or official remediation, and no exploits are currently known in the wild.

Successful exploitation allows a remote authenticated attacker to gain full administrative privileges on the affected Ivanti Neurons for ITSM (On-Premises) system. This can lead to complete compromise of the system's confidentiality, integrity, and availability. Given the administrative access, attackers could manipulate configurations, access sensitive data, disrupt services, or deploy further attacks within the environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should carefully control and monitor authenticated user access to Ivanti Neurons for ITSM (On-Premises) to limit exposure. No vendor-provided mitigations or temporary fixes are currently documented.