The vulnerability is a deserialization of untrusted data flaw (CWE‑502) that lets an authenticated attacker run arbitrary code on the Neurons for ITSM server. Because the attacker must first authenticate, the attack scope is limited to the privileges of that user; however, any code execution on the server can compromise the confidentiality, integrity, and availability of customer data and the entire IT service management environment.

Ivanti Neurons for ITSM, versions before 2026.2, are affected by this flaw. All deployments of the product that have not applied the 2026.2 release or later are vulnerable.

The CVSS score of 8.8 indicates a high severity and the EPSS score of 1% indicates a very low but nonzero exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The attack path requires a remote authenticated session, so the attacker must have valid credentials and sufficient permissions on the system. Based solely on the description, it appears the flaw can be exploited by sending specially crafted serialized payloads through the application’s deserialization endpoint, leading to arbitrary code execution on the host.