Kwetsbaarheden verholpen in Ivanti Neurons for ITSM
Affects Nationaal Cyber Security Centrum IvantiSource GCVE Database
Not known to be exploited · CVSS 9.9 Critical : monitor for a fix to Nationaal Cyber Security Centrum Ivanti.
Data as of 10/24/2026, 20:40:29 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 1.2% chance of exploitation in 30 days – higher than 69% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
The vulnerabilities have been fixed by Ivanti as per the Nationaal Cyber Security Centrum advisory. Users should apply the official patches or updates provided by Ivanti to remediate these issues. Since no affected versions are specified, users should consult Ivanti's official resources for precise version guidance.
Description
Multiple vulnerabilities have been addressed in Ivanti Neurons for ITSM as reported by the Nationaal Cyber Security Centrum. These include eight distinct CVEs related to issues such as improper authorization and unsafe deserialization. No CVSS scores are provided, and no known exploits in the wild have been reported. The affected versions are not explicitly stated. The vulnerabilities have been fixed according to the advisory.
Impact
The vulnerabilities could potentially allow unauthorized actions or unsafe processing of data within Ivanti Neurons for ITSM, impacting the security posture of affected deployments. However, no active exploitation has been reported, and the vendor has remediated the issues.
Summary
The Nationaal Cyber Security Centrum published an advisory (NCSC-2026-0358) detailing the remediation of eight vulnerabilities in Ivanti Neurons for ITSM, including CVE-2026-12645 and seven additional CVEs. The issues involve weaknesses categorized under CWE-862 (Improper Authorization) and CWE-502 (Deserialization of Untrusted Data). The advisory confirms that these vulnerabilities have been addressed, but does not specify affected versions or provide CVSS metrics.
Weaknesses
- CWE-862Missing Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #4OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
- CWE-502Deserialization of Untrusted Data (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #15OWASP Top 10 A08:2025: Software or Data Integrity Failures (opens in a new tab)
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.