A deserialization of untrusted data vulnerability in Ivanti Neurons for ITSM allows a remote unauthenticated attacker to execute arbitrary code on the server. The weakness matches CWE‑502, meaning that the application incorrectly trusts data it receives, leading to uncontrolled code execution. The high CVSS score of 9.8 indicates a critical security flaw that can compromise confidentiality, integrity, and availability of the affected system.

The vulnerability affects Ivanti Neurons for ITSM versions preceding 2026.2. It is relevant to all customers running any earlier release of the product, regardless of configuration, as the issue resides in the core deserialization logic used by the server.

With a CVSS score of 9.8, the flaw is considered critical. Although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the lack of authentication and remote nature of the exploit mean that a network attacker can trigger arbitrary code execution by sending a specially crafted payload to the vulnerable service. The absence of additional mitigation steps in the advisory suggests that the product only removes the flaw in the 2026.2 release or later.