The vulnerability is a stored cross‑site scripting flaw in Ivanti Neurons for ITSM, present in all releases before version 2025.4. A malicious authenticated user can inject JavaScript that is later rendered in the browser for other users’ sessions. The injected code runs with the privileges of the victim user, enabling the attacker to read restricted session information and thereby compromise confidentiality. This behavior is classified as CWE‑79.

Affected components include the cloud and on‑premise editions of Ivanti Neurons for ITSM. Versions prior to 2025.4 are impacted, meaning any organization using an older deployment faces the same risk unless upgraded.

The CVSS score is 5.4, indicating medium severity, while EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers would need remote authenticated access and user interaction to trigger the payload, reducing the immediacy compared to an unauthenticated exploit. However, a single compromised account could repeatedly affect many users once the stored payload is inserted.