Ivanti Neurons for ITSM: Unauth Deserialization RCE Pair (CVE-2026-12744 / 12745)

Ivanti’s September batch includes two unauthenticated remote code execution bugs in Neurons for ITSM, and on-prem operators have to install the fix themselves.

What happened

On September 8–9, 2026, Ivanti disclosed a cluster of critical and high bugs across Neurons for ITSM, Sentry, and EPMM. Inside Neurons for ITSM, six issues rate critical; the two that matter most for internet-facing risk are CVE-2026-12744 and CVE-2026-12745: deserialization of untrusted data (CWE-502) that a remote attacker can hit without authentication, scoring CVSS 9.8.

Ivanti also fixed related missing-authorization and authenticated deserialization issues (including CVE-2026-12647 / 12645 / 12646 / 12650 at 9.9). Cloud/SaaS tenants were patched by Ivanti earlier; on-premises customers must apply the September 2026 security updates for trains 2025.2 through 2026.1, or move to 2026.2 (fixes included; rollout window around September 21).

Ivanti states it has no evidence of in-the-wild exploitation as of the advisory — use that time to patch.

Why it matters

ITSM platforms hold tickets, attachments, credentials, discovery data, and often privileged connectors into AD, email, and endpoints. Unauth RCE on that brain is a one-request path from “self-service portal on the internet” to “operator on your helpdesk stack.” Even when exploitation is not yet observed, CVSS 9.8 unauth deserialization historically does not stay quiet once PoCs circulate.

What to do first

• Confirm whether you run on-prem Neurons for ITSM. SaaS: verify Ivanti’s cloud fix landed. On-prem: apply September 2026 security updates for 2025.2 / 2025.3 / 2025.4 / 2026.1, or upgrade to 2026.2+.
• Pull any self-service / customer portal URLs off the public internet until patched — or put them behind SSO + IP allowlists.
• Review admin creation, plugin/extension installs, and unexpected process trees on the ITSM hosts since early September.
• While you are in the Ivanti batch: patch Sentry (CVE-2026-83527 unauth auth-bypass to admin) and EPMM (CVE-2026-18851) on the same change window if those products are in scope.

Details

• CVEs (unauth RCE): CVE-2026-12744, CVE-2026-12745 (CVSS 9.8, CWE-502)
• Related critical (authz / deser): CVE-2026-12647, CVE-2026-12645, CVE-2026-12646, CVE-2026-12650 (CVSS 9.9)
• Product: Ivanti Neurons for ITSM (on-prem before 2026.2; cloud patched by vendor)
• Fixed: September 2026 security updates for 2025.2–2026.1; included in 2026.2
• Exploitation (vendor): None known at disclosure
• KEV: Not listed as of brief build

Hunt / verify

• Confirm build/version string shows a September-patched train or 2026.2+.
• Inventory internet-exposed ITSM and self-service URLs; compare to CMDB.
• Hunt web logs for anomalous POSTs with serialization payloads to ITSM endpoints pre-patch.
• Spot-check service accounts the ITSM host can reach (AD, SMTP, RMM, cloud APIs).

Sources

• https://www.ivanti.com/en-gb/blog/september-2026-security-update
• https://www.securityweek.com/ivanti-patches-critical-flaws-across-enterprise-security-products/
• https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-Multiple-CVEs?language=en_US
• https://nvd.nist.gov/vuln/detail/CVE-2026-12745
• https://nvd.nist.gov/vuln/detail/CVE-2026-12744

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].