CVE-2026-12645 is a critical missing authorization flaw (CVSS 9.9) in Ivanti Neurons for ITSM before version 2026.2. A remote attacker who is already authenticated can execute arbitrary code on the server. The fix is to move to 2026.2 or later, after checking Ivanti's advisory for details.
What's affected
- Ivanti Neurons for ITSM before 2026.2, per the CVE record. The record gives no other product lines.
- Fixed: the record says versions before 2026.2 are affected, which points to 2026.2 or later as the fixed line. The advisory should be checked for the exact build.
- Severity: CVSS 9.9 Critical (vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The attacker needs a valid low privilege account.
- Ivanti published one advisory covering several CVEs. Siblings in the same record set include CVE-2026-12646, CVE-2026-12647, CVE-2026-12650.
I could not read the Ivanti advisory text when preparing this post, because the page returned only a loading notice. The version boundary below comes from the CVE record. Open the advisory yourself to confirm the exact fixed release and any extra steps.
How to check if you're exposed
Find your Neurons for ITSM version in the administration console, or ask whoever manages the platform. If it is a cloud tenant managed by Ivanti, ask Ivanti or your account contact which release your tenant runs, and whether this fix has been rolled out.
There is no package manager command for this one, since the product is a commercial service desk platform. The useful checks are administrative:
- Confirm the version number against 2026.2.
- List which accounts can sign in, and how many are low privilege or service accounts. The attack needs authentication, so account hygiene reduces exposure.
- Check whether the application is reachable from the internet or only from an internal network.
What to do now
- Confirm the Neurons for ITSM version in use and whether you host it yourself.
- Upgrade to 2026.2 or later after reading Ivanti's advisory for the exact build and instructions.
- Limit network access to the application to the networks that need it.
- Audit accounts, and disable unused or shared logins, because the flaw needs a valid sign in.
- Review server logs for unexpected process activity from the application, dating back to the last time you upgraded.
Why it matters
The weakness is CWE-862 (Missing Authorization). The application performs an action for a signed in user without checking whether that user is allowed to perform it. When the action is something that reaches code execution on the server, a low privilege login becomes a path to full host control.
The scope changed flag in the vector (S:C) means the impact extends beyond the vulnerable component, which fits a service desk platform that holds tickets, credentials in notes and integrations with other systems. The record does not list this as a CISA KEV entry. Service desk tools tend to have many users, so the number of accounts that could reach this flaw is large.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need an account?
Yes. The record calls the attacker remote and authenticated, and the vector shows low privileges required.
Is it exploited in the wild?
The record does not mark it as a CISA KEV entry, and I could not read the advisory to check its exploitation statement. Confirm with Ivanti.
Sources
Last reviewed: 18 October 2026.
