What is the CVSS score of CVE-2026-9614?

CVE-2026-9614 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Ivanti Neurons ITSM are affected by CVE-2026-9614?

Ivanti Neurons for ITSM (cloud and on-premises) contains a privilege escalation vulnerability (CVSS 8.8) that allows authenticated users to escalate to administrative access, directly compromising IT…

How to fix or mitigate CVE-2026-9614?

Within 24 hours: Audit and document all Ivanti Neurons for ITSM instances (cloud and on-premises) and review authentication logs for privilege escalation attempts. Within 7 days: Restrict network access to Ivanti systems via firewall rules and enforce multi-factor authentication on all user accounts. Within 30 days: Monitor Ivanti security advisories for patch releases and prepare deployment timeline; implement privileged access management (PAM) for all administrative functions.

Ivanti Neurons ITSM CVE-2026-9614

EUVD-2026-33736 HIGH

Improper Access Control (CWE-284)

2026-06-01 ivanti

GHSA-x7fw-vc93-jg9v

Ivanti Authentication Bypass

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 19:20 vuln.today

DescriptionCVE.org

An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative access.

AnalysisAI

Privilege escalation to administrative access in Ivanti Neurons for ITSM (both cloud and on-premises deployments) allows a remote authenticated attacker to bypass access controls and obtain admin-level permissions. The flaw carries a CVSS 8.8 rating with low attack complexity, and Ivanti has published a security advisory; no public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

Ivanti Neurons for ITSM is an IT service management platform offered in both SaaS (cloud) and customer-hosted (on-premises) editions, used for ticketing, asset, and workflow management with role-based access controls separating standard users from administrators. The root cause is classified as CWE-284 (Improper Access Control), meaning the application fails to correctly enforce authorization checks on a privileged function or resource, letting an already-authenticated low-privilege account perform actions reserved for administrators. The two affected CPEs - cpe:2.3:a:ivanti:neurons_for_itsm_(on-premises) and cpe:2.3:a:ivanti:neurons_for_itsm_(cloud) - indicate the defect resides in shared application logic rather than a deployment-specific component, and the 'Authentication Bypass' tag suggests the broken control may be an authorization decision invoked after login rather than the login mechanism itself.

RemediationAI

Patch available per vendor advisory - administrators of on-premises Neurons for ITSM should consult https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-CVE-2026-9614 to identify and deploy the fixed build for their currently installed version; cloud-edition tenants are remediated by Ivanti and should confirm their tenant has been updated. Until patching is complete, restrict network reachability of the ITSM web interface to trusted management networks or VPN, tighten provisioning so that low-privilege accounts are not created unnecessarily and disable any inactive accounts, and enforce MFA on all ITSM logins to raise the cost of obtaining the authenticated foothold the exploit requires. Increase monitoring of audit logs for unexpected role changes, privilege grants, or administrative actions originating from non-admin accounts, accepting that these controls reduce but do not eliminate exposure for any user who already holds valid credentials.