This vulnerability (CVE-2026-9614) in Ivanti Neurons for ITSM (On-Premises) involves improper access control (CWE-284) that enables a remote attacker with valid authentication to escalate privileges and obtain administrative access. The CVSS 3.1 score of 8.8 reflects that the attack vector is network-based, requires low attack complexity, low privileges, no user interaction, and results in high impact on confidentiality, integrity, and availability. The vendor has published the vulnerability but has not yet provided a patch or official remediation level. The vulnerability is currently not known to be exploited in the wild.

Successful exploitation allows a remote authenticated attacker to gain administrative privileges on the affected Ivanti Neurons for ITSM (On-Premises) system. This can lead to full system compromise, including unauthorized access to sensitive data, modification or deletion of information, and disruption of service availability. Given the administrative access gained, the impact is high across confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should carefully control and monitor authenticated user access to Ivanti Neurons for ITSM (On-Premises) and apply the principle of least privilege. Review and restrict user permissions to minimize risk of privilege escalation. Monitor for suspicious activity from authenticated users. Do not assume the vulnerability is mitigated without vendor confirmation.