A missing authorization flaw in Ivanti Neurons for ITSM allows an attacker who has valid credentials to run arbitrary code on the affected server. The weakness falls under CWE-862, reflecting the failure to correctly enforce user privileges. If exploited, the attacker can compromise the entire application server, potentially exposing sensitive data and enabling further lateral movement.

Ivanti Neurons for ITSM installations prior to version 2026.2 are vulnerable. The issue applies to all releases of the product before the 2026.2 update, regardless of host environment or configuration, as long as the server is reachable by an authenticated user.

The flaw has a CVSS base score of 9.9, indicating very high severity. The EPSS score is not available, and the vulnerability is not yet listed in CISA KEV. The attack requires valid user credentials, implying that an attacker must first obtain or guess legitimate login information. Once authenticated, the attacker can trigger the exploit and achieve remote code execution on the application server.