Neurons For Itsm On Premise CVE-2026-4914

The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates a moderately exploitable vulnerability requiring network access, low complexity, authenticated access (PR:L), and user interaction. The CVSS base score of 5.4 reflects medium severity with limited confidentiality and integrity impact but no availability impact. EPSS exploitation probability data is not provided in available intelligence. The stored XSS mechanism (as opposed to reflected XSS) increases real-world risk because payloads persist and affect multiple users over time, yet the requirement for user interaction and authentication constraints the attack surface to users with legitimate account access. This is a real priority for Ivanti ITSM operators, particularly in organizations where user account credentials may be compromised or shared; however, it is not a critical vulnerability due to the lack of unauthenticated remote code execution or denial-of-service impact.

An authenticated attacker with valid ITSM credentials injects a malicious JavaScript payload into a user-editable field (such as a ticket comment or incident description) within Ivanti Neurons for ITSM. When another user views the compromised record, the stored script executes in their browser session, allowing the attacker to harvest session cookies, CSRF tokens, or other sensitive information visible to that user. No public exploit code has been identified, but the vulnerability is straightforward to exploit given authenticated access.