Ivanti Neurons for ITSM patches critical flaws

Ivanti fixed multiple critical deserialization and authorization vulnerabilities in Neurons for ITSM allowing arbitrary code execution.

NCSC-NL published an advisory covering multiple vulnerabilities patched by Ivanti in Neurons for ITSM, including deserialization of untrusted data and missing authorization issues. Several of these flaws carry near-maximum CVSS v3 scores (up to 9.9), indicating that successful exploitation could allow an unauthenticated or low-privileged attacker to perform unauthorized actions, including arbitrary remote code execution on the server. No evidence of active in-the-wild exploitation is mentioned in the advisory.

Ivanti has released version 2026.2 to remediate these vulnerabilities. Given the severity scores and the nature of the flaws (deserialization bugs are frequently chained with authorization bypasses for full remote code execution), organizations running Ivanti Neurons for ITSM should prioritize patching to the fixed version. Defenders should monitor for unusual server-side process execution, unexpected deserialization activity, and unauthorized administrative actions on affected ITSM instances as part of detection efforts pending patch deployment.

title: Ivanti Neurons for ITSM Unexpected Child Process Execution
description: Detects child processes spawned from Ivanti Neurons for ITSM application
  processes (typically Java/Tomcat based), which is rare in legitimate operation and
  may indicate exploitation of deserialization or authorization bypass vulnerabilities.
tags:
- attack.execution
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
    - Ivanti
    - Neurons
    ParentImage|endswith:
    - \java.exe
    - \tomcat.exe
    - \catalina.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \wmic.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \mshta.exe
    - \rundll32.exe
  filter_legitimate_admin:
    CommandLine|contains:
    - System32
    - Windows\\System32
    - Get-Process
    - Get-Service
  condition: selection and not filter_legitimate_admin
falsepositives:
- Legitimate system diagnostics or monitoring tools spawned by Ivanti update/maintenance
  processes
- Third-party monitoring agents integrated with Ivanti that invoke system utilities
level: high
id: 29cd5766-184b-53de-864d-f4eb2710473d
status: experimental
author: Vorant

title: Ivanti Neurons for ITSM Unauthorized Administrative Action
description: Detects HTTP requests to Ivanti Neurons for ITSM administrative endpoints
  from low-privilege or unauthenticated contexts, or privilege escalation attempts
  via API, consistent with authorization bypass exploitation patterns.
tags:
- attack.privilege-escalation
- attack.t1078.001
logsource:
  category: proxy
  product: proxy
detection:
  selection:
    c_uri|contains: Ivanti
    cs_user_agent|contains:
    - curl
    - Wget
    - python
    - java
  filter_known_admin:
    cs_username|contains:
    - admin
    - administrator
    - service
    cs_host|contains:
    - internal
    - corp
  filter_legitimate_tools:
    c_uri|contains:
    - status
    - health
    - version
  condition: selection and not (filter_known_admin or filter_legitimate_tools)
falsepositives:
- Legitimate IT service accounts performing administrative actions during maintenance
  windows
- Automated monitoring or compliance scanning tools querying Ivanti endpoints
level: medium
id: ad1b80da-f172-5bf8-8118-8ffbc4f81a8e
status: experimental
author: Vorant

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0358.html