Ivanti Neurons for ITSM Improper Path Protection Vulnerability Allowing Access Retention

A vulnerability in Ivanti Neurons for ITSM (On-Premise) versions through 2025.3 has been identified, allowing remote authenticated attackers to retain access even after their accounts have been disabled. This issue arises from improper protection of an alternate path, enabling unauthorized access persistence.

Impact

Exploitation of this vulnerability allows remote authenticated attackers to maintain access to the application, bypassing account deactivation measures.

Remediation

Users can update to Ivanti Neurons for ITSM version 2025.4 (On-Premise) to address this vulnerability. This version is available for download through the Ivanti License System (ILS). For cloud customers, the fix was applied automatically on 12 December 2025.