CVE-2026-12745: Ivanti Neurons for ITSM RCE Vulnerability

CVE-2026-12745 Overview

CVE-2026-12745 is a deserialization of untrusted data vulnerability [CWE-502] in Ivanti Neurons for ITSM versions prior to 2026.2. The flaw allows a remote, unauthenticated attacker to execute arbitrary code on the server. Because the attack requires no authentication and can be launched over the network, exposed instances face immediate risk of full compromise. Ivanti published a security advisory covering this and other CVEs affecting Neurons for ITSM.

Critical Impact
Unauthenticated remote code execution against Ivanti Neurons for ITSM servers, enabling full server takeover, data theft, and lateral movement into ITSM-integrated systems.

Affected Products

Ivanti Neurons for ITSM versions before 2026.2
On-premises Ivanti Neurons for ITSM deployments
Any integrated ITSM workflow or connector reachable from the vulnerable server

Discovery Timeline

2026-09-08 - CVE-2026-12745 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database
2026-09-11 - EPSS score recorded at 2.093% (80.5 percentile)

Technical Details for CVE-2026-12745

Vulnerability Analysis

The vulnerability stems from insecure deserialization of attacker-controlled data by the Ivanti Neurons for ITSM application. When a server deserializes untrusted input without validating type, structure, or origin, an attacker can craft a serialized object that triggers arbitrary code execution during the deserialization process.

Because the affected endpoint is reachable over the network and does not require authentication, an attacker only needs network access to the ITSM server. Successful exploitation grants execution in the context of the ITSM service account, which typically holds broad access to ticket data, integrations, and configuration management databases.

Root Cause

The root cause is classified as CWE-502: Deserialization of Untrusted Data. The application accepts serialized payloads from an unauthenticated source and reconstructs objects without enforcing an allow-list of expected types or verifying integrity. This behavior lets attacker-supplied gadget chains execute during object construction or callback handling.

Attack Vector

An attacker sends a crafted serialized payload to a network-exposed Ivanti Neurons for ITSM endpoint. The server deserializes the payload and invokes gadget logic that runs arbitrary commands. No user interaction, credentials, or elevated privileges are required. Public technical details are limited; consult the Ivanti Security Advisory: Multiple CVEs for vendor-supplied specifics.

Detection Methods for CVE-2026-12745

Indicators of Compromise

Unexpected child processes spawned by the Ivanti Neurons for ITSM application or its web worker, including cmd.exe, powershell.exe, or shell interpreters
Outbound network connections from the ITSM server to unknown or newly registered domains shortly after inbound HTTP POST traffic
New service accounts, scheduled tasks, or persistence artifacts on the ITSM host that do not match change-management records
Anomalous serialized payloads (for example, base64-encoded .NET or Java streams) in application or reverse-proxy access logs

Detection Strategies

Alert on the Ivanti Neurons for ITSM service process launching interactive shells, scripting engines, or LOLBins
Monitor HTTP request bodies to ITSM endpoints for oversized or binary payloads inconsistent with normal ticket traffic
Correlate authentication logs, process creation events, and outbound network flows to identify unauthenticated request chains that precede code execution behavior

Monitoring Recommendations

Ingest ITSM server application, IIS or reverse-proxy, and Windows event logs into a centralized SIEM for retrospective hunting
Enable command-line auditing and PowerShell script block logging on the ITSM host
Track file writes to the ITSM installation directory and web root to catch dropped web shells or modified assemblies

How to Mitigate CVE-2026-12745

Immediate Actions Required

Upgrade Ivanti Neurons for ITSM to version 2026.2 or later as identified in the Ivanti security advisory
Restrict network access to the ITSM management and API endpoints to trusted administrative networks only
Review the ITSM server for signs of compromise, including new accounts, scheduled tasks, and unexpected files in the web root
Rotate credentials, API keys, and service account passwords stored or used by the ITSM platform after patching

Patch Information

Ivanti has released a fixed version in Ivanti Neurons for ITSM 2026.2. Refer to the Ivanti Security Advisory: Multiple CVEs for full remediation guidance, download links, and any prerequisite update steps.

Workarounds

Place the ITSM application behind a web application firewall (WAF) and block requests containing suspicious serialized object signatures
Enforce network segmentation so the ITSM server cannot initiate arbitrary outbound connections to the internet
Disable or firewall off any unused ITSM connectors or APIs that expose deserialization endpoints until the patch is applied