CVE-2026-9614: An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative access

Synopsis

An improper access control vulnerability in Ivanti Neurons for ITSM (both cloud and on-premises deployments) allows a remote authenticated attacker to escalate their privileges to administrative level. The service is exposed over the network and requires only a low-privilege account to exploit, with no victim interaction needed (CVSS 8.8, HIGH). Successful exploitation gives the attacker full administrative control over the ITSM instance, enabling read, write, and denial-of-service actions against the platform. Patched-image rebuilds at the fixed versions (2025.2 Patch 1, 2025.3 Patch 1, 2025.4 Patch 1, 2026.1 Patch 9, and 2026.2 Patch 1) are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Ivanti Neurons for ITSM service over the network (AV:N), meaning any internet- or intranet-exposed deployment is in scope.

• AuthenticationRequired

  The attacker must hold a valid low-privilege account on the ITSM instance (PR:L); anonymous access alone is not sufficient.

• Victim interactionNot required

  No action from a legitimate user or administrator is needed to trigger the vulnerability (UI:N).

• Attack complexityDetail

  Exploitation is reliable and requires no special race conditions or environmental setup (AC:L); an attacker with a valid account can execute the privilege escalation consistently.

Blast Radius

• The attacker gains administrative control over the ITSM instance, giving full read access to all tickets, user records, and configuration data stored in the platform.
• With administrative write access, the attacker can modify or delete service records, workflows, and user account settings.
• The attacker can create or elevate additional accounts, persisting access even after the initial vulnerability is remediated.
• Administrative access enables disabling of integrations or core ITSM services, disrupting operations for teams dependent on the platform.