Two Vulnerabilities Patched in Ivanti Neurons for ITSM
Ivanti patches two medium-severity vulnerabilities in Neurons for ITSM affecting account access and session data.
Summary
Ivanti released security updates for Neurons for ITSM to address two medium-severity flaws: CVE-2026-4913 (CVSS 5.7) allows authenticated attackers to retain access after account disabling, and CVE-2026-4914 (CVSS 5.4) is a stored XSS vulnerability enabling session data theft. Both vulnerabilities were resolved in version 2025.4, with cloud deployments patched on December 12, 2025, and no known wild exploitation reported.
Full text
Ivanti on Tuesday updated Neurons for ITSM to resolve two medium-severity vulnerabilities affecting both on-premises and cloud deployments. The first bug, tracked as CVE-2026-4913 (CVSS score of 5.7), is described as the improper protection of an alternate path. According to Ivanti, it could allow “a remote authenticated attacker to retain access when their account has been disabled”. The second flaw, CVE-2026-4914 (CVSS score of 5.4), is described as a stored cross-site scripting (XSS) issue that can be abused remotely to obtain limited information from other user sessions. Successful exploitation of the weakness requires authentication and user interaction, Ivanti notes in its advisory. Both vulnerabilities were resolved in Ivanti Neurons for ITSM version 2025.4. Users are advised to update their deployments as soon as possible.Advertisement. Scroll to continue reading. “No action is required for customers using the cloud solution as the fix was applied to all cloud environments on 12 December 2025,” Ivanti says. The company says it is not aware of either of these vulnerabilities being exploited in the wild. No other Ivanti products are affected. On Tuesday, Ivanti also updated its advisory on CVE-2025-26465 and CVE-2025-26466, two OpenSSH flaws disclosed in February 2026. Ivanti EPMM, Sentry and Connector are not affected by the two bugs, but an updated OpenSSH version will be included in future releases, the company says. Related: Organizations Warned of Exploited Windows, Adobe Acrobat Vulnerabilities Related: SAP Patches Critical ABAP Vulnerability Related: Fortinet, Ivanti, Intel Patch High-Severity Vulnerabilities Related: Juniper Networks Patches Dozens of Junos OS Vulnerabilities Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. More from Ionut Arghire SAP Patches Critical ABAP VulnerabilityTriad Nexus Evades Sanctions to Fuel CybercrimeGoogle Adds Rust DNS Parser to Pixel Phones for Better SecurityOrganizations Warned of Exploited Windows, Adobe Acrobat VulnerabilitiesFake Claude Website Distributes PlugX RATGmail Brings End-to-End Encryption to Android and iOS for Enterprise UsersJuniper Networks Patches Dozens of Junos OS VulnerabilitiesOrthanc DICOM Vulnerabilities Lead to Crashes, RCE Latest News Mirax RAT Targeting Android Users in Europe$10 Domain Could Have Handed Hackers 25k Endpoints, Including in OT and Gov NetworksTrump Urges Extending Foreign Surveillance Program as Some Lawmakers Push for US Privacy ProtectionsFortinet Patches Critical FortiSandbox VulnerabilitiesICS Patch Tuesday: 8 Industrial Giants Publish New Security AdvisoriesMicrosoft Patches Exploited SharePoint Zero-Day and 160 Other VulnerabilitiesAdobe Patches 55 Vulnerabilities Across 11 Products‘Mythos-Ready’ Security: CSA Urges CISOs to Prepare for Accelerated AI Threats Trending Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: A Step-by-Step Approach to AI Governance April 28, 2026 With "Shadow AI" usage becoming prevalent in organizations, learn how to balance the need for rapid experimentation with the rigorous controls required for enterprise-grade deployment. Register Virtual Event: Threat Detection and Incident Response Summit May 20, 2026 Delve into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization. Register People on the MoveThe United States Department of War appointed David Vaughn as Technical Advisor for Data Infrastructure.Black Duck has named Dom Glavach as Chief Information Security Officer.Finite State has named Ann Miller as Vice President of Marketing.More People On The MoveExpert Insights The Hidden ROI of Visibility: Better Decisions, Better Behavior, Better Security Beyond monitoring and compliance, visibility acts as a powerful deterrent, shaping user behavior, improving collaboration, and enabling more accurate, data-driven security decisions. (Joshua Goldfarb) The New Rules of Engagement: Matching Agentic Attack Speed The cybersecurity response to AI-enabled nation-state threats cannot be incremental. It must be architectural. (Nadir Izrael) The Next Cybersecurity Crisis Isn’t Breaches—It’s Data You Can’t Trust Data integrity shouldn’t be seen only through the prism of a technical concern but also as a leadership issue. (Steve Durbin) Why Agentic AI Systems Need Better Governance – Lessons from OpenClaw Agentic AI platforms are shifting from passive recommendation tools to autonomous action-takers with real system access, (Etay Maor) The Human IOC: Why Security Professionals Struggle with Social Vetting Applying SOC-level rigor to the rumors, politics, and 'human intel' can make or break a security team. (Joshua Goldfarb) Flipboard Reddit Whatsapp Whatsapp Email
Indicators of Compromise
- cve — CVE-2026-4913
- cve — CVE-2026-4914
- cve — CVE-2025-26465
- cve — CVE-2025-26466