Search criteria

3 vulnerabilities found for Neurons for ITSM (On-Premises) by Ivanti

CERTFR-2026-AVI-0677

Vulnerability from certfr_avis - Published: 2026-06-02 - Updated: 2026-06-02

Une vulnérabilité a été découverte dans les produits Ivanti. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
Ivanti Neurons for ITSM (On-Premises) Neurons for ITSM (On-Premises) version 2025.3 antérieures à 2025.3 Patch 1
Ivanti Neurons for ITSM (Cloud) Neurons for ITSM (Cloud) version 2026.1 antérieures à 2026.1 patch 9
Ivanti Neurons for ITSM (On-Premises) Neurons for ITSM (On-Premises) version 2025.2 antérieures à 2025.2 Patch 1
Ivanti Neurons for ITSM (On-Premises) Neurons for ITSM (On-Premises) version 2025.4 antérieures à 2025.4 Patch 1
Ivanti Neurons for ITSM (Cloud) Neurons for ITSM (Cloud) version 2026.2 antérieures à 2026.2 patch 1
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Neurons for ITSM (On-Premises) version 2025.3 ant\u00e9rieures \u00e0 2025.3 Patch 1 ",
      "product": {
        "name": "Neurons for ITSM (On-Premises)",
        "vendor": {
          "name": "Ivanti",
          "scada": false
        }
      }
    },
    {
      "description": "Neurons for ITSM (Cloud) version 2026.1 ant\u00e9rieures \u00e0 2026.1 patch 9",
      "product": {
        "name": "Neurons for ITSM (Cloud)",
        "vendor": {
          "name": "Ivanti",
          "scada": false
        }
      }
    },
    {
      "description": "Neurons for ITSM (On-Premises) version 2025.2 ant\u00e9rieures \u00e0 2025.2 Patch 1 ",
      "product": {
        "name": "Neurons for ITSM (On-Premises)",
        "vendor": {
          "name": "Ivanti",
          "scada": false
        }
      }
    },
    {
      "description": "Neurons for ITSM (On-Premises) version 2025.4 ant\u00e9rieures \u00e0 2025.4 Patch 1 ",
      "product": {
        "name": "Neurons for ITSM (On-Premises)",
        "vendor": {
          "name": "Ivanti",
          "scada": false
        }
      }
    },
    {
      "description": "Neurons for ITSM (Cloud) version 2026.2 ant\u00e9rieures \u00e0 2026.2 patch 1",
      "product": {
        "name": "Neurons for ITSM (Cloud)",
        "vendor": {
          "name": "Ivanti",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-9614",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9614"
    }
  ],
  "initial_release_date": "2026-06-02T00:00:00",
  "last_revision_date": "2026-06-02T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0677",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-06-02T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans les produits Ivanti. Elle permet \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits Ivanti",
  "vendor_advisories": [
    {
      "published_at": "2026-06-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Ivanti Security-Advisory-Ivanti-Neurons-for-ITSM-CVE-2026-9614",
      "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-CVE-2026-9614"
    },
    {
      "published_at": "2026-06-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Ivanti june-2026-ivanti-neurons-for-itsm-security-update",
      "url": "https://www.ivanti.com/blog/june-2026-ivanti-neurons-for-itsm-security-update"
    }
  ]
}

CVE-2026-9614 (GCVE-0-2026-9614)

Vulnerability from nvd – Published: 2026-06-01 17:50 – Updated: 2026-06-02 03:56
VLAI
Summary
An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative access.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-284 - Improper Access Control
Assigner
References
Impacted products
Vendor Product Version
Ivanti Neurons for ITSM (On-Premises) Unaffected: 2025.4 Patch 1 (custom)
Unaffected: 2025.3 Patch 1 (custom)
Unaffected: 2025.2 Patch 1 (custom)
Create a notification for this product.
Ivanti Neurons for ITSM (Cloud) Unaffected: 2026.1 Patch 9 (custom)
Unaffected: 2026.2 Patch 1 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9614",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-01T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T03:56:03.438Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Neurons for ITSM (On-Premises)",
          "vendor": "Ivanti",
          "versions": [
            {
              "status": "unaffected",
              "version": "2025.4 Patch 1",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2025.3 Patch 1",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2025.2 Patch 1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Neurons for ITSM (Cloud)",
          "vendor": "Ivanti",
          "versions": [
            {
              "status": "unaffected",
              "version": "2026.1 Patch 9",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026.2 Patch 1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An Improper Access Control vulnerability in Ivanti\u0026nbsp;Neurons for\u0026nbsp;ITSM\u0026nbsp;(cloud and\u0026nbsp;on-premises)\u0026nbsp;allows a remote authenticated attacker to gain administrative access.\u0026nbsp;"
            }
          ],
          "value": "An Improper Access Control vulnerability in Ivanti\u00a0Neurons for\u00a0ITSM\u00a0(cloud and\u00a0on-premises)\u00a0allows a remote authenticated attacker to gain administrative access."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T17:50:03.264Z",
        "orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
        "shortName": "ivanti"
      },
      "references": [
        {
          "url": "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-CVE-2026-9614"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
    "assignerShortName": "ivanti",
    "cveId": "CVE-2026-9614",
    "datePublished": "2026-06-01T17:50:03.264Z",
    "dateReserved": "2026-05-26T16:30:29.761Z",
    "dateUpdated": "2026-06-02T03:56:03.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-9614 (GCVE-0-2026-9614)

Vulnerability from cvelistv5 – Published: 2026-06-01 17:50 – Updated: 2026-06-02 03:56
VLAI
Summary
An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative access.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-284 - Improper Access Control
Assigner
References
Impacted products
Vendor Product Version
Ivanti Neurons for ITSM (On-Premises) Unaffected: 2025.4 Patch 1 (custom)
Unaffected: 2025.3 Patch 1 (custom)
Unaffected: 2025.2 Patch 1 (custom)
Create a notification for this product.
Ivanti Neurons for ITSM (Cloud) Unaffected: 2026.1 Patch 9 (custom)
Unaffected: 2026.2 Patch 1 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9614",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-01T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T03:56:03.438Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Neurons for ITSM (On-Premises)",
          "vendor": "Ivanti",
          "versions": [
            {
              "status": "unaffected",
              "version": "2025.4 Patch 1",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2025.3 Patch 1",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2025.2 Patch 1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Neurons for ITSM (Cloud)",
          "vendor": "Ivanti",
          "versions": [
            {
              "status": "unaffected",
              "version": "2026.1 Patch 9",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026.2 Patch 1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An Improper Access Control vulnerability in Ivanti\u0026nbsp;Neurons for\u0026nbsp;ITSM\u0026nbsp;(cloud and\u0026nbsp;on-premises)\u0026nbsp;allows a remote authenticated attacker to gain administrative access.\u0026nbsp;"
            }
          ],
          "value": "An Improper Access Control vulnerability in Ivanti\u00a0Neurons for\u00a0ITSM\u00a0(cloud and\u00a0on-premises)\u00a0allows a remote authenticated attacker to gain administrative access."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T17:50:03.264Z",
        "orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
        "shortName": "ivanti"
      },
      "references": [
        {
          "url": "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-CVE-2026-9614"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
    "assignerShortName": "ivanti",
    "cveId": "CVE-2026-9614",
    "datePublished": "2026-06-01T17:50:03.264Z",
    "dateReserved": "2026-05-26T16:30:29.761Z",
    "dateUpdated": "2026-06-02T03:56:03.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}