Ivanti Neurons for ITSM Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Ivanti Neurons for ITSM (On-Premise) versions through 2025.3. This vulnerability allows remote authenticated attackers to access limited information from other user sessions, requiring user interaction to exploit.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can update to Ivanti Neurons for ITSM version 2025.4 (On-Premise), available in the Ivanti License System. For cloud customers, the fix was applied to all environments on December 12, 2025.