Medium

Improper Path Protection in Ivanti Neurons for ITSM

IdentifiersCVE-2026-4913CWE-424· Improper Protection of Alternate…

CVE-2026-4913 is an improper protection of an alternate path vulnerability in Ivanti Neurons for ITSM (N-ITSM) affecting version 2025.3 and earlier, fixed in version 2025.4. The flaw is described as improper protection of an alternate path / protection mechanism failure, allowing a remote authenticated attacker to continue accessing the application even after an administrator has disabled the attacker’s account. Based on the available information, the issue appears to stem from an alternate access path that is not correctly subject to the same account-disable enforcement as the primary path, resulting in incomplete revocation of access.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an authenticated attacker to retain access to Ivanti N-ITSM after their account has been disabled. This undermines account revocation and access control enforcement, potentially enabling continued unauthorized use of the application, access to data and workflows otherwise denied to a disabled account, and persistence within the ITSM environment until the flaw is remediated or access is otherwise terminated.

Mitigation

If you can’t patch tonight, do this now.

If immediate upgrade is not possible, prioritize compensating controls around account revocation and session invalidation for N-ITSM users, especially privileged or recently disabled accounts. Review and terminate active sessions for disabled users, monitor for continued access by accounts marked disabled, and restrict network exposure to trusted administrative and user populations where feasible. However, the primary mitigation is vendor patching to version 2025.4.

Remediation

Patch, then assume compromise.

Upgrade Ivanti Neurons for ITSM to version 2025.4, which contains the vendor fix for CVE-2026-4913. Ivanti stated that version 2025.4 is available through the Ivanti License System for on-premise customers. Cloud-hosted environments were reportedly remediated by Ivanti on December 12, 2025, and cloud customers do not need to take additional action based on the provided information.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

IvantiN-Itsmapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

cyber security newsNews

Apr 14, 2026

Ivanti Neurons for ITSM Vulnerabilities Allow Remote Attacker to Obtain User Sessions - Cyber Security News

An improper path protection flaw in Ivanti Neurons for ITSM that could allow a remote authenticated attacker to retain unauthorized access even after account disablement.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity6