CVE-2026-4913

CVE Enrichment

CVSS: 5.7 MEDIUM
EPSS: 0.59%
EPSS Percentile: 48.17%
CISA KEV: Not listed

Description

Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
Published: 14-Apr-2026 22:16
Last Modified: 27-Oct-2026 04:10
EPSS Date: 2026-11-05
CWE: CWE-424

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:R /
                            S:U /
                            C:H /
                            I:N /
                            A:N

CNA Products / Version Status

Ivanti · Neurons for ITSM (Cloud) Source: CNA · 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
Default status: affected

2025.4 — unaffected
Ivanti · Neurons for ITSM (On-Premise) Source: CNA · 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
Default status: affected

2025.4 — unaffected

References

3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Last enrichment sync: 06-Nov-2026 07:40
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Two newly disclosed vulnerabilities in Ivanti Neurons for IT Service Management (CVE-2026-4913 and CVE-2026-4914) could allow authenticated attackers to persist in user sessions or inject stored XSS payloads to expose Ivanti Neurons ITSM Flaws Could Preserve Sessions and Expose Session Data

CVE (1)

Vendors (1)

Products (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.