Ivanti Neurons for ITSM Flaws Allow Persistent Access, XSS

Affected Environment
Ivanti Neurons for ITSM, both on‑premise and cloud, versions 2025.3 and earlier are affected. Cloud instances were patched by Ivanti in Dec 2025.

Threat Overview
Two authenticated flaws may allow disabled users to retain access and enable stored XSS to read limited data from other sessions with user interaction.

Exposure Timeline
Ivanti fixed cloud systems on 12 Dec 2025 and released 2025.4 for on‑premise. The report was issued 14 Apr 2026; no active exploitation is reported.

Attack Surface
Exposure exists where Ivanti Neurons for ITSM 2025.3 or earlier remains in use. Risk increases where users have broader access or weak privilege controls.

Technical Root Cause
One flaw stems from improper protection of an alternate access path, bypassing account disablement. The other is stored XSS in the application interface.

Exploitation Pathway
An authenticated attacker could use the alternate path to keep access after disablement, or inject stored XSS that, when triggered, reads limited session data.