# Ivanti Neurons for ITSM CVE-2026-9614 — Improper Access Control Privilege Escalation to Administrator

> An improper access control flaw (CWE-284) in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote, authenticated, low-privileged attacker to escalate to administrative access with no user interaction. CVSS 8.8 (HIGH). Cloud environments were remediated by Ivanti on 24-25 May 2026; on-premises deployments at version 2025.4 and earlier require vendor patches.

- **Published:** 2026-06-03T00:00:00Z
- **Last reviewed:** 2026-06-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0676
- **ID:** TL-2026-0676
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-9614

## Description

CVE-2026-9614 is a high-severity improper access control vulnerability (CWE-284) affecting Ivanti Neurons for ITSM, Ivanti's IT service management platform deployed across enterprise help-desk, change-management, and asset-management workflows in both cloud (SaaS) and on-premises form factors. The flaw allows a remote attacker who already holds a valid, low-privileged authenticated session to elevate their effective permissions to full administrator without any user interaction or social engineering.

The root cause is an authorization enforcement gap: the application validates that a user is authenticated but fails to consistently enforce role/object-level access control on privileged administrative functions and/or role-assignment operations. As a result, a low-privileged role (for example a standard service-desk analyst or self-service portal user) can invoke administrative endpoints or manipulate role/permission state that should be restricted to administrators. Because the platform brokers identity, workflow approvals, and integrations with downstream systems (Active Directory connectors, email, asset databases, automation runbooks), administrative access on Neurons for ITSM is a high-value pivot: an attacker can create or modify accounts, alter approval workflows, exfiltrate ticket and asset data, tamper with audit configuration, and abuse automation/integration credentials.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a network-exploitable issue (AV:N) with low attack complexity (AC:L), requiring only low privileges (PR:L) and no user interaction (UI:N), with high impact to confidentiality, integrity, and availability of the ITSM instance. Scope is unchanged (S:U) because the impact is contained to the vulnerable ITSM authorization domain — though that domain itself is security-critical.

Ivanti disclosed the vulnerability in a security advisory published 1 June 2026 (CVE record published the same day, NVD last modified 2 June 2026). The CNA for the CVSS assessment is Ivanti; NVD enrichment was still pending at hunt time. Ivanti's advisory states the company was not aware of any customer exploitation at the time of disclosure, and no public proof-of-concept or indicators of compromise had been released. Cloud customers required no action: Ivanti applied fixes across all cloud environments during the 24-25 May 2026 maintenance windows, landing in cloud build trains 2026.1 Patch 9 and 2026.2 Patch 1. On-premises customers running 2025.4 and earlier must apply Ivanti-published patches: 2025.4 Patch 1 (primary fix) with backported fixes in 2025.3 Patch 1 and 2025.2 Patch 1, distributed via the Ivanti License System / download portal.

This CVE is distinct from the April 2026 medium-severity Neurons for ITSM session-handling flaws (which permitted obtaining user sessions); CVE-2026-9614 is a separate authorization/privilege-escalation defect. Given the network attack vector, low privilege requirement, and broad enterprise deployment of Neurons for ITSM, defenders should treat any unpatched on-premises instance as a priority remediation target and audit administrative role assignments for unexpected grants.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1068 Exploitation for Privilege Escalation
- T1078.004 Valid Accounts: Cloud Accounts
- T1098 Account Manipulation
- T1136 Create Account
- T1098.003 Account Manipulation: Additional Cloud Roles
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1552 Unsecured Credentials
- T1069 Permission Groups Discovery
- T1213 Data from Information Repositories
- T1550 Use Alternate Authentication Material

## Sources

- [NVD — CVE-2026-9614](https://nvd.nist.gov/vuln/detail/CVE-2026-9614)
- [Ivanti Security Advisory — Neurons for ITSM CVE-2026-9614](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-CVE-2026-9614?language=en_US)
- [CVE.org — CVE-2026-9614](https://cve.org/CVERecord?id=CVE-2026-9614)
- [Cybersecurity News — Ivanti ITSM Vulnerability Lets Attackers Gain Admin Privilege](https://cybersecuritynews.com/ivanti-itsm-vulnerability-admin-privilege/)
- [GBHackers — Ivanti ITSM Flaw Could Allow Attackers to Escalate to Admin Access](https://gbhackers.com/ivanti-itsm-flaw/)
- [CERTFR-2026-AVI-0677 — Ivanti vulnerability advisory](https://vulnerability.circl.lu/vuln/certfr-2026-avi-0677)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0676