CVE-2026-12647Patch(ivanti / neurons_for_itsm)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch ivanti neurons_for_itsm systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

ivanti CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-Multiple-CVEs?language=en_US

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

neurons_for_itsm

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 3 signals
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-09-10); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

ivanti

Products

neurons_for_itsm

5 versions affected across 1 product

Deep dive

Activity timeline4 mentions / 3d

Signal classification3 categories

Patch

250.0%

Disclosure

125.0%

General

125.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-08	1	Disclosure1
2026-09-10	2	General1Patch1
2026-09-11	1	Patch1

Full discourse4 posts

YogSotho@YogSoth044d
General
☢️☢️ Ivanti Multi Exploits Framework - for the September 2026 Ivanti Neurons for ITSM CVE cluster ☢️☢️ | CVE-2026-12744 | | CVE-2026-12745 | | CVE-2026-12648 | | CVE-2026-12650 | | CVE-2026-12651 | | CVE-2026-12645 | | CVE-2026-12646 | | CVE-2026-12647 | #ivanti #0days #exploit #security #cybersecurity #cve #rce #antisec #brokensec
Post summary
The post lists several 2026 Ivanti Neurons for ITSM CVEs with no additional context on exploitation or mitigation.
030168795
2.0K followersView on X
GovCERT.CZ@GOVCERT_CZ44d
Patch
🚨 Upozorňujeme na sérii kritických zranitelností v Ivanti Neurons for ITSM. Společnost Ivanti zveřejnila celkem sedm zranitelností (CVE-2026-12744, CVE-2026-12745, CVE-2026-12651, CVE-2026-12650, CVE-2026-12648, CVE-2026-12645, CVE-2026-12646 a CVE-2026-12647) s CVSS skóre až 9.9. Zranitelnosti mohou vzdálenému útočníkovi umožnit spuštění libovolného kódu na serveru. V případě CVE-2026-12744 a CVE-2026-12745 je možné zneužití neautentizovaným útočníkem, zatímco ostatní zranitelnosti vyžadují autentizovaný přístup. Úspěšné zneužití může vést ke kompletnímu převzetí kompromitovaného systému. Dotčené jsou verze Ivanti Neurons for ITSM On-Prem 2025.2, 2025.3, 2025.4 a 2026.1 a cloudová verze 2026.2 před aplikací oprav. 📌Doporučujeme aktualizovat na bezpečnostní záplaty vydané v září 2026 pro verze 2025.2/2025.3/2025.4/2026.1 nebo na verzi 2026.2 (patched), která je již opravena.
Post summary
The message alerts users to seven high‑severity Ivanti Neurons vulnerabilities that allow remote code execution, and recommends applying the September 2026 patches or upgrading to the patched 2026.2 version. It does not mention PoCs or active exploitation.
11010821
4.3K followersView on X
CCB Alert@CCBalert43d
Patch
Warning: Critical vulnerabilities in #Ivanti Neurons for ITSM allow arbitrary code execution. #RCE CVE-2026-12647 CVSS: 9.9, CVE-2026-12744 CVSS: 9.8, CVE-2026-12745 CVSS: 9.8. Read our advisory: https://ccb.belgium.be/advisories/warning-missing-authorization-and-deserialization-vulnerabilities-ivanti-neurons-itsm and #Patch #Patch #Patch
Post summary
An advisory warns about critical RCE vulnerabilities in Ivanti Neurons for ITSM, listing CVEs, CVSS scores and urging a patch, with no PoC, exploit code, or active exploitation reported.
00010293
7.2K followersView on X
Kaitan ID Security@KaitanSecurity46d
Disclosure
🚨 CRITICAL — CVE-2026-12647 A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker t… CVSS 9.9 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-12647 #Ivanti #CyberSecurity #InfoSec
Post summary
The post announces a critical missing‑authorization vulnerability (CVE‑2026‑12647) in Ivanti Neurons for ITSM, noting its high CVSS score, lack of patch, and links to a full analysis.
0000038
86 followersView on X

CPE platform detail5 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

5 of 5 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	ivanti	neurons_for_itsm	2025.2	-	-
App	ivanti	neurons_for_itsm	2025.3	-	-
App	ivanti	neurons_for_itsm	2025.4	-	-
App	ivanti	neurons_for_itsm	2026.1	-	-
App	ivanti	neurons_for_itsm	2026.2	-	-

Explore more

Back to dashboard ivanti CVEs neurons_for_itsm vulnerabilities

What researchers are saying

CVE-2026-12647

YogSotho[verified]@YogSoth0General

The post lists several 2026 Ivanti Neurons for ITSM CVEs with no additional context on exploitation or mitigation.

GovCERT.CZ[verified]@GOVCERT_CZPatch

The message alerts users to seven high‑severity Ivanti Neurons vulnerabilities that allow remote code execution, and recommends applying the September 2026 patches or upgrading to the patched 2026.2 version. It does not mention PoCs or active exploitation.

Kaitan ID Security[verified]@KaitanSecurityDisclosure

The post announces a critical missing‑authorization vulnerability (CVE‑2026‑12647) in Ivanti Neurons for ITSM, noting its high CVSS score, lack of patch, and links to a full analysis.

CCB Alert@CCBalertPatch

An advisory warns about critical RCE vulnerabilities in Ivanti Neurons for ITSM, listing CVEs, CVSS scores and urging a patch, with no PoC, exploit code, or active exploitation reported.