CVE-2026-12744 Overview
CVE-2026-12744 is a deserialization of untrusted data vulnerability [CWE-502] affecting Ivanti Neurons for IT Service Management (ITSM) versions prior to 2026.2. The flaw allows a remote unauthenticated attacker to execute arbitrary code on the server hosting the application. Because Neurons for ITSM often runs with elevated service privileges and integrates with enterprise directories, successful exploitation can lead to full compromise of the ITSM environment and lateral movement into connected systems.
Critical Impact
Unauthenticated remote code execution on Ivanti Neurons for ITSM servers, enabling attacker control of ticketing workflows, credentials, and integrations.
Affected Products
- Ivanti Neurons for ITSM versions prior to 2026.2
- On-premises Ivanti Neurons for ITSM deployments
- Any Ivanti Neurons for ITSM instance exposed to untrusted network traffic
Discovery Timeline
- 2026-09-08 - CVE-2026-12744 published to the National Vulnerability Database
- 2026-09-09 - Last updated in the NVD database
Technical Details for CVE-2026-12744
Vulnerability Analysis
The vulnerability originates in how Ivanti Neurons for ITSM processes serialized objects received from remote clients. The application accepts serialized input and reconstructs objects without validating their type or source. An attacker can submit a crafted serialized payload that triggers gadget chains during deserialization, resulting in arbitrary code execution in the server process.
Because the affected code path does not require authentication, an attacker only needs network reachability to the ITSM service. Successful exploitation grants code execution in the context of the ITSM application, which typically holds credentials for databases, directory services, and downstream automation targets. The EPSS score of 2.167% (81st percentile) reflects meaningful attacker interest in this class of Ivanti flaws.
Root Cause
The root cause is unsafe deserialization of attacker-controlled data. The application deserializes input without enforcing an allow-list of expected types, without integrity verification, and without isolating the deserialization operation. This pattern, tracked as [CWE-502], is a well-established source of unauthenticated remote code execution in enterprise Java and .NET services.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker sends a crafted serialized payload to an exposed Neurons for ITSM endpoint. The server deserializes the payload, instantiates attacker-chosen gadget classes, and executes embedded commands. See the Ivanti Security Advisory on Multiple CVEs for vendor-specific technical context.
Detection Methods for CVE-2026-12744
Indicators of Compromise
- Unexpected child processes spawned by the Ivanti Neurons for ITSM application service, particularly shells, cmd.exe, powershell.exe, or scripting interpreters.
- Outbound network connections from the ITSM server to unknown external hosts shortly after inbound HTTP POST requests.
- New or modified files in application web directories, including .aspx, .ashx, or .jsp webshells.
- Anomalous authentication activity from service accounts associated with Neurons for ITSM.
Detection Strategies
- Inspect web server and application logs for oversized POST requests to ITSM endpoints containing serialized object markers.
- Monitor process lineage on ITSM hosts to identify command execution parented by the application worker process.
- Correlate inbound web traffic with subsequent outbound connections or credential access events on the same host.
Monitoring Recommendations
- Forward Ivanti Neurons for ITSM application, IIS, and Windows event logs to a centralized SIEM or data lake for retention and analysis.
- Alert on service account logons originating from the ITSM host to unexpected internal systems.
- Track outbound connections from ITSM servers against threat intelligence feeds for known command-and-control infrastructure.
How to Mitigate CVE-2026-12744
Immediate Actions Required
- Upgrade Ivanti Neurons for ITSM to version 2026.2 or later on all on-premises deployments.
- Restrict network access to the ITSM application to trusted management networks and identity-aware proxies.
- Rotate credentials, API keys, and service account secrets used by the ITSM application if compromise is suspected.
- Review ITSM application and host logs for indicators of exploitation covering the period before patching.
Patch Information
Ivanti has released a fixed build in Ivanti Neurons for ITSM version 2026.2. Refer to the Ivanti Security Advisory on Multiple CVEs for the complete list of addressed CVEs, upgrade paths, and post-upgrade validation steps. Apply the vendor-supplied update in a staged manner across non-production and production environments.
Workarounds
- Place the Neurons for ITSM web front end behind a web application firewall configured to inspect and block serialized object payloads.
- Limit inbound access to the application to VPN or zero-trust network access users until patching completes.
- Run the ITSM application service under a least-privilege account with restricted database and directory permissions.
- Disable or firewall any external-facing integrations that are not required for business operations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
