CVE-2023-46808 is a critical severity (CVSS 9.9) file upload flaw in Ivanti Neurons for ITSM before 2023.4. An authenticated remote user can write files to the server, which may lead to command execution as a non-root user. Upgrade to 2023.4 or later and confirm details in the Ivanti advisory.
What's affected
The NVD description says Ivanti ITSM before 2023.4 is affected, which points to 2023.4 as the fixed release. The Ivanti advisory page linked from the record loaded only a placeholder in our fetch, so we could not confirm affected editions, fixed builds or mitigations from the vendor. Check it directly.
The vector shows a network attack needing a low privilege account, with a changed scope and high impact across the board. The weakness is CWE-434, unrestricted file upload. The record does not list it in CISA KEV.
The NVD record scores it 9.9 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The weakness class is CWE-434 (unrestricted file upload). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Sign in to the Ivanti Neurons for ITSM admin console and read the version and release. If you run the cloud service, ask Ivanti how your tenant is updated. For on-premises installs, compare against 2023.4.
Also review which accounts exist, because exploitation needs authentication, and inspect the web server's writable folders for unexpected files.
What to do now
- Read the Ivanti advisory for CVE-2023-46808 and confirm your edition and the fixed build.
- Upgrade Neurons for ITSM to 2023.4 or later.
- Review user accounts and remove those you cannot explain.
- Check web directories for files you did not put there.
- Restrict access to the application to trusted networks where you can.
Why it matters
A file write that ends in command execution is a classic path from a modest account to control of the server. The score is nearly maximum because the scope changes and impact is high, even though a login is required.
IT service management tools hold employee data, asset details and often integrate with directory services, so a compromised server is a useful base for an attacker. Prompt upgrade and account hygiene go together.
Quick check
Which version fixes it?
The record says before 2023.4 is affected. Confirm the fixed build in the Ivanti advisory.
Does it need a login?
Yes. The record describes an authenticated remote user.
Sources
Last reviewed: 19 October 2026.
