Ivanti Neurons for ITSM Vulnerabilities Let Remote Attackers Hijack User Sessions

Ivanti has issued a security advisory detailing two medium-severity vulnerabilities affecting its Neurons for IT Service Management (ITSM) platform.

If left unpatched, these security flaws could allow remote authenticated attackers to compromise user sessions and maintain unauthorized access to corporate networks, even after their accounts have been deactivated by administrators.

The vulnerabilities impact both on-premise and cloud deployments of the software running versions 2025.3 and earlier.

Fortunately, Ivanti has confirmed that there is currently no evidence of these vulnerabilities being actively exploited by threat actors in the wild.

Breakdown of the Flaws

The security update addresses two specific vulnerabilities. While both require some level of existing access or user interaction, they pose a notable risk to organizational data security:

• CVE-2026-4913 (CVSS 5.7): This vulnerability stems from the improper protection of an alternate path within the software. It allows a remote, authenticated attacker to retain system access even after their user account has been officially disabled. This “zombie access” could let malicious insiders or compromised users continue monitoring internal systems and workflows long after their privileges should have been revoked.
• CVE-2026-4914 (CVSS 5.4): This flaw is classified as a Stored Cross-Site Scripting (XSS) vulnerability. By leveraging this weakness, a remote authenticated attacker can extract sensitive information from other active user sessions. While this attack requires interaction from the targeted user, it effectively opens the door for session hijacking and unauthorized data exposure across the platform.

Mitigation and Patch Availability

To protect enterprise environments from potential exploitation, Ivanti strongly urges administrators to upgrade their systems to the resolved version, 2025.4. The necessary remediation steps depend entirely on how the software is deployed within an organization.

For organizations utilizing Ivanti Neurons for ITSM in the cloud, no immediate action is required.

Ivanti proactively applied the necessary security fixes to all managed cloud environments late last year on December 12, 2025, fully securing hosted customers against both CVEs.

However, organizations managing on-premise deployments of the platform must take manual action. Security teams and system administrators should immediately log into the Ivanti License System (ILS) portal to download and apply the version 2025.4 patch.

Given the frequent targeting of IT service management tools by threat actors, keeping these centralized platforms updated is essential.

Even though these vulnerabilities are rated as medium severity, attackers often chain less severe bugs together to escalate their privileges and move laterally across an organization’s infrastructure. Prompt patching remains the best defense against unauthorized access.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.