Description
Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ivanti | Neurons for ITSM (On-Premise) | — | 2025.4 |
| Ivanti | Neurons for ITSM (Cloud) | — | 2025.4 |
Advisories 1
- WID-SEC-2026-1120 Ivanti Neurons for ITSM: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen BSI CERT-Bund (WID) · Apr 14, 2026