A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.
In plain language
Written by AI from the record
If you run Ivanti Neurons for ITSM older than 2026.2, you should worry: an attacker may be able to contact your server from the network and run malicious code without logging in.
CVE-2026-12745 is a remote unauthenticated remote code execution (RCE) issue in Ivanti Neurons for ITSM caused by deserialization of untrusted data; attackers can send crafted network data that the server processes in a way that leads to arbitrary code execution.
If you're affected
Full server compromise
Service disruption
Customer/IT data exposure
Ransomware risk
What is it
This flaw lets an attacker trick your Neurons for ITSM server into “reading” malicious data in a way that can cause it to run attacker-controlled code. Think of it like getting a package delivered with a hidden instruction inside—if your system is vulnerable, it may follow the instruction instead of treating it as harmless data.
Who is affected
This matters if you use Ivanti Neurons for ITSM (any version before 2026.2) to run your IT service management workflows. It’s most relevant when the Neurons for ITSM server can be contacted over the network, because the attacker does not need an account or user action. The key reachability gate is network exposure: this becomes a risk if the server is reachable from where an attacker can send network requests (and you’re running a version prior to 2026.2).
How urgent is it
This is RED because the vulnerability is remote and unauthenticated, meaning an attacker can attempt it without logging in. Ivanti has released updates to fix multiple critical Neurons for ITSM issues in September 2026, including this one, so you should treat it as an urgent patching priority.
What to do — in detail
Confirm exposure and version
Identify the exact Ivanti Neurons for ITSM version currently installed.
Determine whether it is prior to 2026.2.
Validate network reachability
Check whether your Neurons for ITSM server is reachable from the public internet (or from untrusted networks).
Review firewall rules, reverse-proxy rules, and any port-forwarding that exposes Neurons for ITSM services.
Upgrade to the fixed version
Upgrade Ivanti Neurons for ITSM to 2026.2.
After upgrading, confirm the service starts correctly and that normal ITSM functions work.
If you cannot upgrade right away (temporary controls)
Restrict access so the Neurons for ITSM server is not reachable from the public internet.
Allow only known administrative IP ranges/VPN users (use your standard management path rather than direct exposure).
What to monitor after the change
Review Neurons for ITSM logs and system logs for unusual inbound requests around the vulnerable service.
Look for repeated failed requests or unexpected crashes/restarts that could indicate probing.
Expected timeline
There is no KEV listing for this specific CVE in the provided findings.
Because this is unauthenticated remote code execution and the fixed version is known (2026.2), remediation should be prioritized immediately within your patch window.
Technical context
Severity is critical (RCE) with a weakness consistent with deserializing untrusted data (CWE-502). The mechanism described in the findings is that an attacker can send malicious network data to an Ivanti Neurons for ITSM server without authentication and without user interaction, leading to execution of arbitrary code on the server.
Exploitation status: KEV is not listed in CISA KEV, and no public exploit code is known. The provided press reporting does not include clear dated evidence of real-world exploitation for this specific CVE, but it states unauthenticated exploitability.
Fix: Ivanti has fixed this in neurons for itsm 2026.2.
EPSS note: a prediction is provided (2.1%) and is listed as flat, but this should not be treated as proof of exploitability; the findings emphasize unauthenticated remote attack capability and a known patch version.
What to take away: if you run a vulnerable Neurons for ITSM version and it is reachable over the network, the attacker can attempt RCE without logging in.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
