CVE-2026-12646 is one of several critical missing authorization flaws (CVSS 9.9) in Ivanti Neurons for ITSM before 2026.2. A remote authenticated attacker can execute arbitrary code on the server. Upgrade to 2026.2 or later and read Ivanti's advisory for the exact build.
What's affected
- Ivanti Neurons for ITSM before 2026.2, per the CVE record. The record gives no other product lines.
- Fixed: the record says versions before 2026.2 are affected, which points to 2026.2 or later as the fixed line. The advisory should be checked for the exact build.
- Severity: CVSS 9.9 Critical (vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The attacker needs a valid low privilege account.
- Ivanti published one advisory covering several CVEs. Siblings in the same record set include CVE-2026-12645, CVE-2026-12647, CVE-2026-12650.
I could not read the Ivanti advisory text when preparing this post, because the page returned only a loading notice. The version boundary below comes from the CVE record. Open the advisory yourself to confirm the exact fixed release and any extra steps.
How to check if you're exposed
Find your Neurons for ITSM version in the administration console, or ask whoever manages the platform. If it is a cloud tenant managed by Ivanti, ask Ivanti or your account contact which release your tenant runs, and whether this fix has been rolled out.
There is no package manager command for this one, since the product is a commercial service desk platform. The useful checks are administrative:
- Confirm the version number against 2026.2.
- List which accounts can sign in, and how many are low privilege or service accounts. The attack needs authentication, so account hygiene reduces exposure.
- Check whether the application is reachable from the internet or only from an internal network.
What to do now
- Confirm the Neurons for ITSM version in use and whether you host it yourself.
- Upgrade to 2026.2 or later after reading Ivanti's advisory for the exact build and instructions.
- Limit network access to the application to the networks that need it.
- Audit accounts, and disable unused or shared logins, because the flaw needs a valid sign in.
- Review server logs for unexpected process activity from the application, dating back to the last time you upgraded.
Why it matters
This CVE shares its description, score and weakness class (CWE-862 (Missing Authorization)) with its siblings in the Ivanti advisory. The public records do not say which endpoint or function is involved, and defenders should not guess. What they do say is the same: a signed in user reaches functionality they should not, and that functionality runs code on the server.
For patching purposes, treat the group as one change. Upgrading past 2026.2 is the stated remedy for the whole advisory. The more useful extra work is reducing the number of accounts that could be abused, and keeping the platform off the open internet where possible.
Quick check
Does the attacker need an account?
Yes. The record calls the attacker remote and authenticated, and the vector shows low privileges required.
Is it exploited in the wild?
The record does not mark it as a CISA KEV entry, and I could not read the advisory to check its exploitation statement. Confirm with Ivanti.
Sources
Last reviewed: 18 October 2026.
