Ivanti Neurons for ITSM (On-Premise)

• CVE-2026-4914 Medium 5.4 Stored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain limited information from other user sessions. User interaction is required. 0.3%
• CVE-2026-4913 Medium 5.7 Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled. 0.6%