CVE-2026-12744

Think of Neurons for ITSM like a mailroom that automatically opens and processes incoming parcels. This flaw is like a “dangerous parcel” that can be crafted to run code inside your server, without the attacker needing an account. If it’s reachable, the attacker may be able to take over your system or disrupt your IT services.

This matters if you run Ivanti Neurons for ITSM and your installed version is older than 2026.2. Because the attack does not require login or user action, the risk is mainly about whether the vulnerable service can be reached over the network. Treat it as a risk when the Neurons for ITSM server is network-accessible (especially from the internet); otherwise, the exposure may be limited to internal users who can reach it.

This is urgent because the vulnerability allows a remote attacker to execute arbitrary code on the server without authentication. The fix is available (2026.2), and exploitation risk is high enough to warrant immediate remediation rather than waiting.

1. Confirm exposure

   • Identify the exact Neurons for ITSM version running in your environment.
   • If it is before 2026.2, you should treat this as affected.

2. Upgrade to the fixed version

   • Upgrade Ivanti Neurons for ITSM to 2026.2.
   • Ensure you follow your vendor’s upgrade procedure (including required prerequisites, backups, and any database migration steps).

3. Validate after the upgrade

   • Confirm the running version is 2026.2 in the product’s admin/about page.
   • Check service health (start-up logs, error-free application behavior, and that core ITSM functions still work).

4. If you can’t upgrade right away (temporary containment)

   • Block public network access to the Neurons for ITSM server.
   • Restrict inbound connections to only the necessary admin/support sources (specific IPs/VPN only), and deny all others at the firewall/load balancer.
   • Monitor inbound traffic for unexpected requests targeting the Neurons for ITSM endpoints while you work on upgrading.

5. What to monitor

   • Look for signs of compromise in Neurons for ITSM and the host system logs after any suspicious network activity.
   • Review for unusual process execution or outbound connections from the Neurons for ITSM server.

Timing note

• No KEV listing was found in the provided sources.
• Ivanti issued fixes in September 2026 security updates (per the provided news item), and the fixed product line is 2026.2.

Severity and nature: The described weakness is unsafe handling of serialized data (CWE-502), allowing deserialization of untrusted input to be turned into executable actions.

Attack conditions: A remote attacker can execute arbitrary commands on the server without logging in (no authentication required, no user interaction). The attack vector is network-based, and the precondition is that the target runs Ivanti Neurons for ITSM before 2026.2.

Exploitation status: Confirmed exploitation in the provided sources is not clearly dated in the news report, no CISA KEV listing was provided, and no public exploit code is on record. However, the operational risk remains high because the flaw directly enables remote unauthenticated code execution.

Fix: The product is fixed in Neurons for ITSM 2026.2.

Maturity signals: Exploit code not found (per findings) and a flat low predicted likelihood were provided; these do not change the fact that the mechanism is command execution when reachable and unpatched. Provided “press attention” indicates rising interest (actor noted: Chaotic Eclipse), but the decisive control is upgrading to 2026.2.