WARNING: Missing authorization and deserialization vulnerabilities in Ivanti Neurons for ITSM can be exploited to execute arbitrary code. Patch immediately!

Ivanti Neurons for ITSM (on-premises versions 2025.2, 2025.3, 2025.4, and 2026.1 prior to the September 2026 update) contains three critical vulnerabilities — one missing-authorization issue (CVE-2026-12647) and two deserialization flaws (CVE-2026-12744, CVE-2026-12745) — that can lead to arbitrary code execution (the latter two are exploitable remotely without authentication); organizations are strongly advised to apply the September 2026 security update, increase monitoring, and report incidents to the relevant CERT.