CVE-2026-4913: Ivanti N-ITSM Auth Bypass Vulnerability

CVE-2026-4913 Overview

CVE-2026-4913 is an improper protection of an alternate path vulnerability (CWE-424) affecting Ivanti Neurons for ITSM (N-ITSM) before version 2025.4. This authentication bypass flaw allows a remote authenticated attacker to retain access to the system even after their account has been disabled by administrators.

Critical Impact

Disabled user accounts can maintain persistent unauthorized access to Ivanti N-ITSM systems through alternate authentication paths, potentially allowing continued data exfiltration or malicious activity despite administrative deprovisioning efforts.

Affected Products

• Ivanti Neurons for ITSM versions prior to 2025.4

Discovery Timeline

• April 14, 2026 - CVE-2026-4913 published to NVD
• April 14, 2026 - Last updated in NVD database

Technical Details for CVE-2026-4913

Vulnerability Analysis

This vulnerability stems from improper protection of an alternate authentication path within Ivanti Neurons for ITSM. When an administrator disables a user account through the standard administrative interface, the system fails to properly invalidate all authentication mechanisms associated with that account.

The flaw allows previously authenticated users to bypass account status checks by leveraging alternative authentication endpoints or session mechanisms that do not properly verify the account's disabled status. This creates a significant security gap in the account lifecycle management process, particularly concerning for organizations that need to immediately revoke access for terminated employees or compromised accounts.

From an exploitation perspective, the vulnerability requires network access and prior authentication to the system, meaning an attacker must have had legitimate access at some point. However, no user interaction is required from victims once the attacker has established their persistence mechanism.

Root Cause

The root cause is classified as CWE-424 (Improper Protection of Alternate Path). The application fails to properly implement account status checks across all authentication and session validation pathways. While the primary authentication flow may correctly reject disabled accounts, alternate code paths—potentially including API endpoints, session renewal mechanisms, or legacy authentication handlers—do not perform adequate verification of the account's current status.

Attack Vector

The attack is network-based and requires the attacker to have previously authenticated to the Ivanti N-ITSM instance. The exploitation scenario involves:

1. An attacker with legitimate credentials authenticates to the system and establishes a persistent session or discovers an alternate authentication endpoint
2. An administrator subsequently disables the attacker's account through normal administrative procedures
3. The attacker continues accessing the system through the alternate path that does not properly validate account status
4. The attacker retains read access to sensitive information despite their account being disabled

The vulnerability specifically impacts confidentiality, allowing unauthorized access to sensitive ITSM data including potentially service tickets, configuration data, and organizational information. For detailed technical information, refer to the Ivanti Security Advisory.

Detection Methods for CVE-2026-4913

Indicators of Compromise

• Successful authentication or session activity from user accounts that have been disabled in the administrative console
• API access logs showing requests from accounts that should no longer have access
• Unusual session longevity for accounts that were recently deprovisioned
• Authentication events occurring through non-standard endpoints after account disable operations

Detection Strategies

• Implement logging correlation between account disable events and subsequent access attempts from those accounts
• Monitor for API endpoint usage patterns that differ from standard user authentication flows
• Configure alerts for any successful authentication events from accounts in disabled state
• Review session management logs for sessions that persist beyond account deprovisioning actions

Monitoring Recommendations

• Enable comprehensive audit logging for all authentication pathways including API endpoints
• Implement real-time correlation rules to detect access from recently disabled accounts
• Configure SIEM rules to alert on authentication anomalies within 24-48 hours of account status changes
• Regularly audit active sessions against current account status in the directory

How to Mitigate CVE-2026-4913

Immediate Actions Required

• Upgrade Ivanti Neurons for ITSM to version 2025.4 or later immediately
• Audit all disabled user accounts and terminate any active sessions associated with them
• Review access logs for evidence of exploitation on disabled accounts
• Implement network segmentation to limit exposure of Ivanti N-ITSM to untrusted networks

Patch Information

Ivanti has released version 2025.4 of Neurons for ITSM which addresses this vulnerability. Organizations should apply this update as soon as possible following their change management procedures. Consult the Ivanti Security Advisory for CVE-2026-4913 for complete patch details and upgrade instructions.

Workarounds

• Implement additional authentication controls at the network layer to restrict access to the ITSM platform
• Configure web application firewall rules to monitor and potentially block suspicious authentication patterns
• When disabling accounts, also manually invalidate all associated sessions and API tokens
• Consider implementing additional identity verification for sensitive ITSM operations until patching is complete