Ivanti Neurons for ITSM Vulnerabilities Let Remote Attackers Obtain User Sessions

Ivanti released an advisory for two medium-severity vulnerabilities in Ivanti Neurons for ITSM (CVE-2026-4913 — improper protection of an alternate path allowing persistent "zombie" access after account disablement; CVE-2026-4914 — stored XSS enabling capture of data from other sessions). Cloud instances were patched automatically to version 2025.4, while on-premise installations must be manually updated via the Ivanti License System; no active exploitation has been observed but organizations are urged to patch promptly due to the central role of ITSM platforms.