Improper Path Protection in Ivanti Neurons for ITSM

Successful exploitation allows an authenticated user to retain access to Ivanti Neurons for ITSM after administrative account disablement. This undermines account revocation and access-control enforcement, allowing continued use of the platform despite an explicit administrative action intended to terminate access. In practice, this can enable unauthorized continued access to service management functions and data available to the compromised or disabled account until the vulnerability is remediated.

If immediate patching is not possible, organizations should tightly monitor disabled and recently deprovisioned accounts for any continued activity, review authentication and application access logs for signs that revoked accounts are still being used, and accelerate account lifecycle controls such as session invalidation and credential rotation where applicable. Restricting access for low-privilege authenticated users and validating that account disablement is consistently enforced across all access paths may reduce exposure, but upgrading to a fixed version is the definitive mitigation.

Upgrade Ivanti Neurons for ITSM to version 2025.4 or later. Ivanti patched the vulnerability in version 2025.4. For cloud deployments, the vendor applied the fix to cloud environments on December 12, 2025, and no customer action is required. On-premises customers should manually obtain and apply the 2025.4 update through Ivanti’s standard software distribution channel as a priority.