Description
An authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Security Patch allows a remote unauthenticated attacker to gain administrative access to the system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ivanti | Neurons for ITSM (on-prem) | — | 2023.4 w/ May 2025 Security Patch |
Advisories 2
- WID-SEC-2025-1104 Ivanti Neurons for ITSM: Schwachstelle ermöglicht Erlangen von Administratorrechten BSI CERT-Bund (WID) · May 20, 2025
- NCSC-2025-0161 Kwetsbaarheid verholpen in Ivanti Neurons for ITSM NCSC-NL (Netherlands) · May 14, 2025