Ivanti Neurons ITSM Flaws Could Preserve Sessions and Expose Session Data
Summary
Ivanti Neurons for ITSM versions 2025.3 and earlier are affected by flaws that could preserve access after account deactivation or expose limited session data via stored XSS. Ivanti says it has no evidence of exploitation.
Key points
- CVE-2026-4913 could let an authenticated attacker retain access through an alternate path after account deactivation.
- CVE-2026-4914 is a stored XSS flaw that could expose limited session data if another user interacts with the injected script.
- Both vulnerabilities affect Ivanti Neurons for ITSM versions 2025.3 and earlier in cloud and on-premises deployments.
- Ivanti says it was not aware of customer exploitation at disclosure and had identified no indicators of compromise.
- Ivanti automatically patched cloud environments on December 12, 2025; on-premises customers should update to version 2025.4 through the Ivanti License System.
Article Details
- Vulnerability Types
- Improper protection of an alternate path
- Stored cross-site scripting (XSS)
- Severity
- Medium (CVSS 5.7 for CVE-2026-4913; CVSS 5.4 for CVE-2026-4914)
- Affected Versions
- Ivanti Neurons for IT Service Management 2025.3 and earlier
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-4913Ivanti · Neurons for ITSM (Cloud); Ivanti · Neurons for ITSM (On-Premise)Two newly disclosed vulnerabilities in Ivanti Neurons for IT Service Management (CVE-2026-4913 and CVE-2026-4914) could allow authenticated attackers to persist in user sessions or inject stored XSS payloads to exposeCVE-2026-4914Ivanti · Neurons for ITSM (Cloud); Ivanti · Neurons for ITSM (On-Premise)Two newly disclosed vulnerabilities in Ivanti Neurons for IT Service Management (CVE-2026-4913 and CVE-2026-4914) could allow authenticated attackers to persist in user sessions or inject stored XSS payloads to expose