Ivanti Neurons for ITSM, both Cloud and On‑Premise, contains an improperly protected alternate path that allows a remote authenticated user to continue interacting with the system after their account has been disabled. This flaw can let an attacker maintain session activity beyond the intended account deactivation point, potentially giving them ongoing, unauthorized access. The weakness aligns with CWE‑424, representing a logical error where an entity’s intended user access controls are overridden or bypassed.

All versions of Ivanti Neurons for ITSM released before 2025.4 are impacted. The vulnerability applies to both the Cloud and On‑Premise editions and is not tied to a particular operating system or hardware configuration.

The CVSS score of 5.7 reflects a moderate impact, indicating that continued access could lead to unauthorized actions but does not guarantee full privilege escalation. EPSS data is not available, so precise exploit probability cannot be assessed. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires the attacker to be a legitimate user of the system; once authenticated, they can exploit the alternate path to retain access after the account has been disabled. The attack vector is remote, network‑based, and authenticated. The available information does not disclose whether attackers have already exploited this flaw in production environments.