CVE-2026-12651 Ivanti CVE debrief

Who should care

ITSM administrators, security teams, and individuals responsible for Ivanti Neurons for ITSM instances. Additional personnel who should care include operators managing affected ITSM deployments, platform owners ensuring system security, vulnerability management teams assessing exposure, and security teams verifying compensating controls.

Why it matters

CVE-2026-12651 is a high-severity vulnerability in Ivanti Neurons for ITSM that allows remote authenticated attackers to execute arbitrary code on the server. ITSM administrators and security teams should assess exposure and apply patches or updates to version 2026.2 or later. The vulnerability has a CVSS score of 8.8 and is classified as HIGH severity. Evidence is limited, and further verification is required to determine the full scope of affected versions and potential impact.

• Potential remote code execution on ITSM systems
• Compromise of ITSM systems by authenticated attackers
• Elevation of privileges on ITSM systems
• Data tampering or unauthorized access on ITSM systems

Technical summary

CVE-2026-12651 is a Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before version 2026.2. A remote authenticated attacker can exploit this vulnerability to execute arbitrary code on the server. The vulnerability has a CVSS score of 8.8 and is classified as HIGH severity.

Defensive priority

High priority for ITSM administrators and security teams to assess exposure and apply patches

Recommended defensive actions

• Assess exposure of Ivanti Neurons for ITSM instances
• Apply patches or updates to version 2026.2 or later
• Monitor for suspicious activity on ITSM systems
• Verify authentication and authorization controls

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, but do not specify which versions are fixed or provide additional details on exploitation

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.