Threat reportVulnerabilityTL-2026-0676
Ivanti Neurons for ITSM CVE-2026-9614 — Improper Access Control Privilege Escalation to Administrator
Ivanti Neurons for ITSM CVE-2026-9614 (TL-2026-0676) is a high-severity software vulnerability scored CVSS 8.8, first published 2026-06-03. It has no confirmed attribution, affects Ivanti Neurons for ITSM (on-premises), references 1 CVE (CVE-2026-9614), maps to 13 MITRE ATT&CK techniques (T1068, T1069, T1070), and is covered by 9 detection rules and 12 indicators of compromise.
- CVSS
- 8.8/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-0676
- Threat ID
- TL-2026-0676
- Severity
- HIGH
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, financial, healthcare, government, manufacturing, education
- Target regions
- Global, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 12
How Ivanti Neurons for ITSM CVE-2026-9614 works
An improper access control flaw (CWE-284) in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote, authenticated, low-privileged attacker to escalate to administrative access with no user interaction. CVSS 8.8 (HIGH). Cloud environments were remediated by Ivanti on 24-25 May 2026; on-premises deployments at version 2025.4 and earlier require vendor patches.
CVE-2026-9614 is a high-severity improper access control vulnerability (CWE-284) affecting Ivanti Neurons for ITSM, Ivanti's IT service management platform deployed across enterprise help-desk, change-management, and asset-management workflows in both cloud (SaaS) and on-premises form factors. The flaw allows a remote attacker who already holds a valid, low-privileged authenticated session to elevate their effective permissions to full administrator without any user interaction or social engineering.
The root cause is an authorization enforcement gap: the application validates that a user is authenticated but fails to consistently enforce role/object-level access control on privileged administrative functions and/or role-assignment operations. As a result, a low-privileged role (for example a standard service-desk analyst or self-service portal user) can invoke administrative endpoints or manipulate role/permission state that should be restricted to administrators. Because the platform brokers identity, workflow approvals, and integrations with downstream systems (Active Directory connectors, email, asset databases, automation runbooks), administrative access on Neurons for ITSM is a high-value pivot: an attacker can create or modify accounts, alter approval workflows, exfiltrate ticket and asset data, tamper with audit configuration, and abuse automation/integration credentials.
The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a network-exploitable issue (AV:N) with low attack complexity (AC:L), requiring only low privileges (PR:L) and no user interaction (UI:N), with high impact to confidentiality, integrity, and availability of the ITSM instance. Scope is unchanged (S:U) because the impact is contained to the vulnerable ITSM authorization domain — though that domain itself is security-critical.
Ivanti disclosed the vulnerability in a security advisory published 1 June 2026 (CVE record published the same day, NVD last modified 2 June 2026). The CNA for the CVSS assessment is Ivanti; NVD enrichment was still pending at hunt time. Ivanti's advisory states the company was not aware of any customer exploitation at the time of disclosure, and no public proof-of-concept or indicators of compromise had been released. Cloud customers required no action: Ivanti applied fixes across all cloud environments during the 24-25 May 2026 maintenance windows, landing in cloud build trains 2026.1 Patch 9 and 2026.2 Patch 1. On-premises customers running 2025.4 and earlier must apply Ivanti-published patches: 2025.4 Patch 1 (primary fix) with backported fixes in 2025.3 Patch 1 and 2025.2 Patch 1, distributed via the Ivanti License System / download portal.
This CVE is distinct from the April 2026 medium-severity Neurons for ITSM session-handling flaws (which permitted obtaining user sessions); CVE-2026-9614 is a separate authorization/privilege-escalation defect. Given the network attack vector, low privilege requirement, and broad enterprise deployment of Neurons for ITSM, defenders should treat any unpatched on-premises instance as a priority remediation target and audit administrative role assignments for unexpected grants.
MITRE ATT&CK techniques used in TL-2026-0676
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1078.004 Valid Accounts: Cloud Accounts; T1098 Account Manipulation
Discovery
T1069 Permission Groups Discovery
Defense Evasion
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Persistence
T1098.003 Account Manipulation: Additional Cloud Roles; T1136 Create Account
Collection
T1213 Data from Information Repositories
Lateral Movement
T1550 Use Alternate Authentication Material
Credential Access
defense-impairment
Affected products and versions in Ivanti Neurons for ITSM CVE-2026-9614
Remediation for Ivanti Neurons for ITSM CVE-2026-9614
Patches
- On-premises: Ivanti Neurons for ITSM 2025.4 Patch 1
- On-premises backport: 2025.3 Patch 1
- On-premises backport: 2025.2 Patch 1
- Cloud: 2026.1 Patch 9 and 2026.2 Patch 1 (applied by Ivanti 24-25 May 2026; no customer action required)
Immediate actions
- On-premises: apply Ivanti Neurons for ITSM 2025.4 Patch 1 immediately; if pinned to an older train, apply backported 2025.3 Patch 1 or 2025.2 Patch 1 via the Ivanti License System portal
- Audit all administrator and privileged role assignments in Neurons for ITSM and remove any unexpected or unauthorized grants
- Review recent role/permission change events and account-creation activity for low-privileged accounts performing administrative actions
Workarounds
- Restrict access to administrative and role-management endpoints at the reverse proxy/WAF where feasible until patched
- Limit ITSM access to trusted network ranges and enforce MFA on all accounts to raise the bar on obtaining the required low-privileged foothold
Longer-term hardening
- Enforce least privilege and periodic access recertification for ITSM roles
- Place the on-premises ITSM management interface behind VPN/ZTNA and restrict network exposure
- Enable and centrally collect ITSM audit logs (authorization, role change, admin function use) to a SIEM
- Establish a patch SLA for internet-reachable enterprise management platforms
CVEs associated with Ivanti Neurons for ITSM CVE-2026-9614
Weaknesses (CWE) in Ivanti Neurons for ITSM CVE-2026-9614
Timeline of Ivanti Neurons for ITSM CVE-2026-9614
- Ivanti begins applying fixes across cloud environments during scheduled maintenance (cloud build 2026.1 Patch 9 / 2026.2 Patch 1).
- Ivanti completes cloud remediation; all cloud customers protected with no customer action required.
- On-premises patches released: 2025.4 Patch 1 plus backports 2025.3 Patch 1 and 2025.2 Patch 1 via the Ivanti License System portal.
- Ivanti publishes security advisory for CVE-2026-9614; CVE record published. Vendor reports no known exploitation and no public PoC/IOCs.
- NVD record last modified; CVSS 8.8 (Ivanti CNA) recorded, NVD enrichment pending. National CERT advisory CERTFR-2026-AVI-0677 published.
- Threadlinqs Intelligence documents the threat with full MITRE mapping, detection guidance, and remediation.
Sources cited for Ivanti Neurons for ITSM CVE-2026-9614
- NVD — CVE-2026-9614
- Ivanti Security Advisory — Neurons for ITSM CVE-2026-9614
- CVE.org — CVE-2026-9614
- Cybersecurity News — Ivanti ITSM Vulnerability Lets Attackers Gain Admin Privilege
- GBHackers — Ivanti ITSM Flaw Could Allow Attackers to Escalate to Admin Access
- CERTFR-2026-AVI-0677 — Ivanti vulnerability advisory
Detection coverage for TL-2026-0676
As of 2026-06-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0676 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.