This vulnerability is an improper access control flaw in Ivanti Neurons for ITSM that permits a remote attacker who is already authenticated to gain administrative privileges. The flaw is characterized by CWE-284, which reflects a failure to enforce proper authorization checks. As a result, an attacker can manipulate the system with full administrative rights, compromising confidentiality, integrity, and potentially availability of the service.

Ivanti Neurons for ITSM product line, including both the cloud-hosted and on-premises deployments. No specific version information is provided; any deployment of these products is potentially affected.

The CVSS score of 8.8 indicates a high severity risk level. The EPSS score is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is a remote authenticated user exploiting improper access controls to elevate privileges to an administrator. Given the high severity and lack of mitigation details, the vulnerability poses a significant threat to affected systems.