CVE-2026-12647 is a critical missing authorization flaw (CVSS 9.9) in Ivanti Neurons for ITSM before 2026.2. As with its siblings, an authenticated remote attacker can run arbitrary code on the server. Upgrade to 2026.2 or later and confirm the details in Ivanti's advisory.
What's affected
- Ivanti Neurons for ITSM before 2026.2, per the CVE record. The record gives no other product lines.
- Fixed: the record says versions before 2026.2 are affected, which points to 2026.2 or later as the fixed line. The advisory should be checked for the exact build.
- Severity: CVSS 9.9 Critical (vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The attacker needs a valid low privilege account.
- Ivanti published one advisory covering several CVEs. Siblings in the same record set include CVE-2026-12645, CVE-2026-12646, CVE-2026-12650.
I could not read the Ivanti advisory text when preparing this post, because the page returned only a loading notice. The version boundary below comes from the CVE record. Open the advisory yourself to confirm the exact fixed release and any extra steps.
How to check if you're exposed
Find your Neurons for ITSM version in the administration console, or ask whoever manages the platform. If it is a cloud tenant managed by Ivanti, ask Ivanti or your account contact which release your tenant runs, and whether this fix has been rolled out.
There is no package manager command for this one, since the product is a commercial service desk platform. The useful checks are administrative:
- Confirm the version number against 2026.2.
- List which accounts can sign in, and how many are low privilege or service accounts. The attack needs authentication, so account hygiene reduces exposure.
- Check whether the application is reachable from the internet or only from an internal network.
What to do now
- Confirm the Neurons for ITSM version in use and whether you host it yourself.
- Upgrade to 2026.2 or later after reading Ivanti's advisory for the exact build and instructions.
- Limit network access to the application to the networks that need it.
- Audit accounts, and disable unused or shared logins, because the flaw needs a valid sign in.
- Review server logs for unexpected process activity from the application, dating back to the last time you upgraded.
Why it matters
The weakness is CWE-862 (Missing Authorization), a check that should have happened and did not. In ticketing platforms, features multiply over time: workflows, integrations, custom objects and scripting. Each new feature needs its own access check, and a missing one is easy to overlook in review.
That pattern is why several CVEs of the same class can land in one advisory. It is also why upgrading is better than trying to block one endpoint. The record does not say this CVE is in the CISA KEV catalog. Because the attacker only needs a valid login, an old account that nobody reviews is a realistic starting point.
Quick check
Does the attacker need an account?
Yes. The record calls the attacker remote and authenticated, and the vector shows low privileges required.
Is it exploited in the wild?
The record does not mark it as a CISA KEV entry, and I could not read the advisory to check its exploitation statement. Confirm with Ivanti.
Sources
Last reviewed: 18 October 2026.
