Search CVEs, research… / diras.sa

CVE-2026-12744: pre-auth remote code execution in Ivanti Neurons for ITSM

A remote, unauthenticated attacker can execute arbitrary code on Ivanti Neurons for ITSM servers via a deserialization of untrusted data flaw tracked as CVE-2026-12744. This is a CWE-502 deserialization issue with a critical CVSS 3.1 rating indicating network access is sufficient and no privileges or user interaction are required. Vendor data lists all Neurons for ITSM versions as affected and no fixed release is provided, so attackers only need network reachability to the vulnerable service to attempt exploitation.

Published Updated Source: CVE Program, NVD, FIRST EPSS

CVSS 3.1
9.8CRITICAL
EPSS
0.02255
CWE
CWE-502
KEV DUE DATE
Not listed
PATCH
Not yet

DIRAS TAKE

Urgent: prioritize mitigation because all Neurons for ITSM versions are affected and no fixed release is listed; immediately restrict exposure and apply vendor guidance while awaiting a patch.

What is CVE-2026-12744?

A remote, unauthenticated attacker can execute arbitrary code on Ivanti Neurons for ITSM servers via a deserialization of untrusted data flaw tracked as CVE-2026-12744. This is a CWE-502 deserialization issue with a critical CVSS 3.1 rating indicating network access is sufficient and no privileges or user interaction are required. Vendor data lists all Neurons for ITSM versions as affected and no fixed release is provided, so attackers only need network reachability to the vulnerable service to attempt exploitation. The weakness is classified as CWE-502 (Deserialization of Untrusted Data).

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Which versions of Ivanti Neurons for ITSM are affected?

BRANCHAFFECTEDFIXED
Neurons for ITSMall versions

Is CVE-2026-12744 being exploited?

There are no public reports of exploitation as of 2026-09-30.

How to fix CVE-2026-12744

  1. Restrict network access to Neurons for ITSM interfaces; block or firewall management and service ports from untrusted networks.
  2. Apply any Ivanti mitigation guidance and configuration hardening that the vendor provides.
  3. Monitor server and application logs for indicators of code execution, unexpected process launches, and other anomalous activity.
  4. Isolate affected systems where feasible and prepare to deploy vendor-supplied fixes as soon as they become available.

Frequently asked questions

Is CVE-2026-12744 being actively exploited?

There are no public reports of exploitation as of 2026-09-30.

Which Neurons for ITSM versions are affected by CVE-2026-12744?

All versions of Ivanti Neurons for ITSM are listed as affected in the vendor-provided data.

Is there a patch for CVE-2026-12744?

No fixed version is listed in the provided data; a patch is not available according to the vendor information included here.

Does CVE-2026-12744 require authentication?

No, the vulnerability can be exploited by a remote unauthenticated attacker and does not require valid credentials.

References