Ivanti Neurons ITSM CVE-2026-9614

Exploitation requires the attacker to hold valid credentials for any account on the target Neurons for ITSM instance (PR:L) and to have network reachability to the application - for on-premises deployments this means the ITSM web tier must be reachable from the attacker's network position, while cloud tenants are reachable from the public internet by default. No user interaction is required (UI:N) and attack complexity is low (AC:L), so any low-privilege user account is sufficient regardless of role. Limiting factors are the authentication prerequisite itself, any MFA or conditional-access policy in front of the ITSM login, and IP-allowlisting where deployed; the vulnerability affects both cloud and on-premises editions per the CPE data, with no indication that a non-default configuration is required.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high impact across confidentiality, integrity, and availability - a realistic profile for any attacker who can obtain or phish a standard ITSM user account. Because Neurons for ITSM frequently holds sensitive ticket data, integration credentials, and workflow automations, admin takeover translates directly into a high-value foothold for lateral movement. No EPSS score, KEV listing, SSVC decision, or public POC was supplied in the input, so external exploitation signals are absent; the risk should be treated as elevated based on the CVSS profile, vendor self-disclosure, and the historical pattern of Ivanti products attracting opportunistic exploitation, but claims of active exploitation cannot be made from the available data.

An attacker who has phished or otherwise obtained the credentials of an ordinary ITSM end-user (for example a helpdesk requester) authenticates to the Neurons for ITSM web application over the network and invokes a privileged function whose authorization check is missing or improper, elevating their effective role to administrator. From the admin console they then extract integration secrets, modify workflows to exfiltrate ticket data, or create persistent backdoor accounts. No public exploit identified at time of analysis, so an adversary would need to reverse-engineer the patch or the affected endpoint to develop one.