EUVD-2026-72804
GHSA-w2vf-r8hj-2qr9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable deserialization yields code execution with no user interaction, giving full confidentiality, integrity, and availability impact on the server.
Primary rating from Vendor (ivanti).
CVSS VectorVendor: ivanti
Lifecycle Timeline
2DescriptionCVE.org
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.
Articles & Coverage 1
AnalysisAI
Remote code execution in Ivanti Neurons for ITSM prior to version 2026.2 allows a remote, unauthenticated attacker to run arbitrary code on the server by submitting maliciously crafted serialized data that the application deserializes without validation. The flaw carries a CVSS 9.8 rating and requires no authentication or user interaction, making any internet-exposed instance immediately at risk. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of Ivanti Neurons for ITSM before 2026.2, per the CVSS vector AV:N/AC:L/PR:N/UI:N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix: upgrade Ivanti Neurons for ITSM to the 2026.2 patch, which Ivanti identifies as the remediated release (Vendor-released patch: 2026.2), per the advisory at https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-Multiple-CVEs?language=en_US. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of all Ivanti Neurons for ITSM deployments, document current software versions (particularly identifying any running versions prior to 2026.2), and prioritize internet-facing instances for immediate remediation planning. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Neurons For Itsm
View allAn authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Se
Remote code execution in Ivanti Neurons for ITSM versions before 2026.2 allows a low-privileged authenticated attacker t
Remote code execution in Ivanti Neurons for ITSM before version 2026.2 lets an unauthenticated attacker run arbitrary co
An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows a
Remote code execution in Ivanti Neurons for ITSM allows a low-privileged authenticated attacker to execute arbitrary cod
Remote code execution in Ivanti Neurons for ITSM before version 2026.2 is achievable by any authenticated remote attacke
A SQL injection vulnerability in web component of Ivanti Neurons for ITSM allows a remote authenticated user to read/mod
Improper certificate validation in Ivanti ITSM on-prem and Neurons for ITSM Versions 2023.4 and earlier allows a remote
An unrestricted file upload vulnerability in web component of Ivanti Neurons for ITSM allows a remote, authenticated, hi
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today