The vendor has published a fix. Version details are below where the sources state them.
Steps
Written by AI from the record
Check your installed version of Ivanti Neurons for ITSM and confirm whether it is earlier than 2026.2.
If you are on a version before 2026.2, schedule and apply the upgrade to Ivanti Neurons for ITSM 2026.2.
If upgrading immediately isn’t possible, restrict access to the Ivanti Neurons for ITSM network endpoints to only the trusted administrative networks/users until you can upgrade.
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
In plain language
Written by AI from the record
If you use Ivanti Neurons for ITSM, versions before 2026.2 can be tricked by a logged-in attacker into running arbitrary code on your server—so you should upgrade to 2026.2 as soon as possible.
CVE-2026-12650 is a deserialization flaw (CWE-502) in Ivanti Neurons for ITSM (before 2026.2) that allows a remote, low-privilege authenticated attacker to trigger unsafe processing of crafted data and execute arbitrary code on the server.
If you're affected
Full server takeover
Business system outage
Data theft from the server
Ransomware entry point
What is it
Think of Ivanti Neurons for ITSM as your building’s reception desk that processes requests. This vulnerability lets a logged-in attacker send a “fake request package” that the server mistakenly treats as safe and, instead, runs attacker-chosen commands on the server. In practical terms, that can mean attackers gain control of the ITSM server, not just access to a single page or account.
Who is affected
This matters if you run Ivanti Neurons for ITSM and have users who can authenticate (even with limited privileges). The risk applies to deployments on versions before 2026.2.
Reachability details aren’t confirmed in the findings, but the vulnerability requires the attacker to already be authenticated—so it’s mainly a concern if an attacker could obtain credentials or if a user account is compromised.
How urgent is it
This is RED because it allows arbitrary code execution on the server, which can lead directly to full system compromise and service disruption. The attacker only needs low-privilege, valid credentials, and there is mounting press attention tied to this issue.
What to do — in detail
Confirm exposure
Identify the exact “neurons for itsm” version currently deployed.
If the version is earlier than 2026.2, you are in the vulnerable range described by the findings.
Patch (primary action)
Upgrade Ivanti Neurons for ITSM to 2026.2.
If you have multiple environments (test/staging/production), upgrade non-production first to validate behavior, then roll out to production.
Validate after upgrading
Re-check the installed version is now 2026.2.
Monitor the application for errors during/after the upgrade and confirm core ITSM functions still work.
If you cannot patch immediately (temporary containment)
Limit network access to Ivanti Neurons for ITSM to trusted admin networks and known management IP ranges.
Reduce the number of accounts that have the ability to authenticate to the Neurons interface to the minimum necessary.
Treat any signs of account compromise (unexpected logins, new/changed users, unusual session activity) as incident-level events until patched.
What to monitor
Authentication logs for unusual or repeated failed/successful logins.
Admin actions and changes within the application around the same timeframe as suspicious logins.
Server logs for unexpected process execution or command activity originating from the application service context.
CISA KEV
This CVE is not listed in CISA KEV per the findings.
Technical context
Severity is critical: the vulnerability enables arbitrary code execution on the server with the privileges of the application (CWE-502: deserialization of untrusted data). The attack requires remote network access and valid authenticated credentials with low privileges; user interaction is not required. Ivanti Neurons for ITSM is affected only for versions before 2026.2, and the fixed version is 2026.2.
Exploitation status
CISA KEV listing: not listed.
Public exploit code: none on record in the findings.
Press reports: no clear dated exploitation claim provided.
However, the overall verdict for this CVE is RED, driven by the impact (arbitrary code execution) and rising attention.
Attack mechanism (high level)
A remote, authenticated attacker submits maliciously crafted data that the application deserializes/handles unsafely, resulting in execution of attacker-controlled commands on the server.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
