Vulnerability · Published Sep 8, 2026 · Assigned by ivanti
CVE-2026-12745
Critical 9.8
In plain English
A critical-severity unsafe deserialization in Neurons for ITSM from Ivanti. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)2.9%top 12.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ivanti | Neurons for ITSM | see references |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H