Ivanti Neurons for ITSM Vulnerabilities Allow Remote Attacker to Obtain User Sessions

Ivanti issued updates for two medium-severity vulnerabilities in Ivanti Neurons for ITSM (CVE-2026-4913 and CVE-2026-4914). CVE-2026-4913 permits a remote authenticated attacker to retain access even after account disablement, while CVE-2026-4914 is a stored XSS that can exfiltrate limited session data; both require user interaction and affect versions before 2025.4. Ivanti patched the issues in version 2025.4 (cloud environments already updated on Dec 12, 2025) and reports no evidence of active exploitation, advising on-premise customers to upgrade immediately.