- The Mess: Ivanti shipped a cluster of critical flaws in Neurons for ITSM, including a 9.9 deserialization bug that can turn a low-privileged account into remote code execution.
- The Damage: An attacker who gets a basic ITSM account can potentially jump from application access to control of the underlying server.
- The Fix: Update Neurons for ITSM to 2026.2 immediately and audit low-privileged accounts and application logs.
Ivanti has another unpleasant patch cycle.
This time the target is Neurons for ITSM, and the September security update contains multiple critical vulnerabilities. The most interesting one is CVE-2026-12650, a deserialization-of-untrusted-data flaw rated CVSS 9.9.
The vulnerability affects Neurons for ITSM versions before 2026.2.
And it has an ugly requirement:
The attacker needs authentication.
But not administrator authentication.
The CVE record specifies only low privileges, no user interaction and network exploitation. Successful exploitation can result in arbitrary code execution on the server, with the CVSS scope marked as changed.
Authentication Is Not Much of a Barrier
This is where the vulnerability becomes interesting.
“Authenticated RCE” often sounds less dangerous than an unauthenticated exploit.
That can be misleading in enterprise software.
ITSM platforms naturally contain large numbers of accounts.
Employees.
Support staff.
Service accounts.
External users.
Contractors.
Compromising one low-privileged account can therefore be enough to reach the vulnerable application.
CVE-2026-12650 then provides the next step.
The flaw is caused by unsafe deserialization. Attacker-controlled serialized data can be processed by the application in a way that allows arbitrary code execution.
That is a classic server-side exploitation pattern.
The application becomes the execution engine.
Ivanti Has More Than One Problem Here
CVE-2026-12650 isn’t the only critical issue disclosed in the update.
CVE-2026-12646 and CVE-2026-12647 are missing-authorization vulnerabilities, both rated 9.9. They also allow a remote authenticated attacker with low privileges to execute arbitrary code.
That is a much worse pattern than a single isolated bug.
Three separate attack paths.
Same product.
Same basic privilege level.
Same potential destination: code execution on the server.
The CVE records currently show no CISA KEV listing and no public exploit for these vulnerabilities.
That does not make them harmless.
It means defenders still have a window to patch before somebody turns the advisory into a working exploit.
The Fix Is 2026.2
Ivanti lists 2026.2 as unaffected for CVE-2026-12650 and the related Neurons for ITSM vulnerabilities.
Older versions should be treated as vulnerable.
The Canadian Centre for Cyber Security has already included the September Ivanti Neurons for ITSM vulnerabilities in its September 8 advisory and recommends administrators review Ivanti’s guidance and apply the available updates.
The important part is not just updating the application.
Check the accounts that can access it.
Look for recently created low-privileged users.
Review authentication logs.
Review unusual requests to ITSM endpoints.
And investigate unexpected server-side process execution.
If an attacker already has an account, the patch only closes the vulnerability.
It does not explain how that account got compromised in the first place.
Ivanti Has History Here
This is also not the first time Ivanti appliances have become attractive targets.
Earlier this year, Ivanti Sentry suffered CVE-2026-10520, a CVSS 10.0 unauthenticated OS command-injection flaw, and CVE-2026-10523, a CVSS 9.9 authentication bypass. CVE-2026-10520 was added to CISA KEV after evidence of active exploitation.
That history makes the current Neurons vulnerabilities worth treating aggressively.
There is no public exploitation evidence for the September Neurons flaws right now.
But attackers already know Ivanti is a valuable enterprise target.
Bugstoday Opinion
The phrase “requires authentication” should not make a 9.9 RCE disappear from the priority list.
ITSM systems are built around authentication.
They have users.
They have integrations.
They have service accounts.
They often sit close to sensitive operational data.
CVE-2026-12650 does not need an administrator to start the chain.
It needs a low-privileged account.
That is a much smaller obstacle.
Three critical Neurons for ITSM vulnerabilities landed in the same update cycle. There is no public PoC yet, and that is exactly why defenders should patch now — before there is one.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- Ivanti — Security Advisory for Neurons for ITSM
- CVE — CVE-2026-12650
- CVE — CVE-2026-12646
- CVE — CVE-2026-12647
- Canadian Centre for Cyber Security — Ivanti Security Advisory
- OpenCVE — CVE-2026-12646
