EUVD-2026-72797
GHSA-rqrh-xrq8-v5c4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Pre-auth network-reachable deserialization yielding server code execution supports AV:N/AC:L/PR:N/UI:N with full C/I/A impact; scope unchanged as execution stays within the app host.
Primary rating from Vendor (ivanti).
CVSS VectorVendor: ivanti
Lifecycle Timeline
2DescriptionCVE.org
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.
Articles & Coverage 1
AnalysisAI
Remote code execution in Ivanti Neurons for ITSM before version 2026.2 lets an unauthenticated attacker run arbitrary code on the server by submitting maliciously crafted serialized data (CWE-502). Any internet- or network-reachable Neurons for ITSM instance on an unpatched build is exploitable without credentials or user interaction, per the vendor-issued CVSS 9.8 vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of Ivanti Neurons for ITSM on any build before 2026.2, consistent with AV:N/AC:L/PR:N/UI:N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes the worst realistic profile for a server app: network-reachable, low complexity, no privileges, no user interaction, full CIA impact - deserialization RCE flaws of this kind are frequently automatable once a working gadget chain is published. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Ivanti Neurons for ITSM to 2026.2 or later, which remediates this deserialization flaw; follow the guidance in the Ivanti security advisory at https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-Multiple-CVEs?language=en_US. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of all Ivanti Neurons for ITSM deployments and identify which systems run versions prior to 2026.2. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Neurons For Itsm
View allAn authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Se
Remote code execution in Ivanti Neurons for ITSM versions before 2026.2 allows a low-privileged authenticated attacker t
Remote code execution in Ivanti Neurons for ITSM prior to version 2026.2 allows a remote, unauthenticated attacker to ru
An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows a
Remote code execution in Ivanti Neurons for ITSM allows a low-privileged authenticated attacker to execute arbitrary cod
Remote code execution in Ivanti Neurons for ITSM before version 2026.2 is achievable by any authenticated remote attacke
A SQL injection vulnerability in web component of Ivanti Neurons for ITSM allows a remote authenticated user to read/mod
Improper certificate validation in Ivanti ITSM on-prem and Neurons for ITSM Versions 2023.4 and earlier allows a remote
An unrestricted file upload vulnerability in web component of Ivanti Neurons for ITSM allows a remote, authenticated, hi
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today