Ivanti ITSM Flaw Could Allow Attackers to Escalate to Admin Access

Ivanti has patched a high-severity vulnerability in its Ivanti Neurons for ITSM platform that could allow authenticated attackers to escalate privileges and gain full administrative access to affected systems.

Tracked as CVE-2026-9614, the flaw is classified as an improper access control issue (CWE-284) and carries a CVSS score of 8.8. The vulnerability affects both cloud and on-premises deployments, making it significant for enterprises that rely on Ivanti ITSM to manage critical IT operations.

According to the advisory, the issue allows a remote attacker with low-privileged authenticated access to elevate privileges without requiring any user interaction.

The vulnerability stems from insufficient authorization checks within the application, enabling attackers to bypass role-based access controls.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS :3.1/ AV : N / AC : L / PR : L / UI : N / S : U / C : H / I : H / A : H highlights that the attack requires low complexity and no user interaction, increasing the likelihood of exploitation in exposed environments.

If successfully exploited, attackers could gain administrative control, access sensitive configuration data, manipulate workflows, and potentially move laterally across enterprise systems.

Ivanti confirmed that the vulnerability affects Ivanti Neurons for ITSM on-premises versions 2025.4 and earlier, as well as cloud versions 2026.1 and prior. To address the issue, Ivanti released patches for on-premises deployments in versions 2025.4 Patch 1, 2025.3 Patch 1, and 2025.2 Patch 1.

For cloud customers, the issue has already been remediated through service updates, specifically in versions 2026.1 Patch 9 and 2026.2 Patch 1, with fixes automatically applied between May 24 and May 25, 2026.

Although Ivanti stated that there is no evidence of active exploitation at the time of disclosure, the vulnerability presents a high risk due to its ease of exploitation and potential impact. Threat actors commonly target IT management platforms to gain persistent access and control over enterprise environments.

Organizations using on-premises deployments are strongly advised to immediately apply the latest patches, restrict access to ITSM interfaces, monitor logs for suspicious activity, and audit the use of privileged accounts to detect potential abuse.

Given the critical role of ITSM platforms in enterprise infrastructure, vulnerabilities such as CVE-2026-9614 underscore the importance of timely patching and continuous monitoring to prevent privilege-escalation attacks and maintain security integrity.

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

A newly analyzed leak tied to The Gentlemen ransomware group reveals how modern ransomware operations…

A critical security flaw in the Kirki – Freeform Page Builder, Website Builder & Customizer…

Expiring Microsoft Secure Boot keys will not brick unmigrated systems on June 27, 2026. However,…

Apache ActiveMQ users are being urged to apply immediate patches following the disclosure of a…

Analysis has revealed that 38% of organizations are running GitHub Actions workflows vulnerable to script…

A threat campaign in which attackers leveraged AI-powered tools to streamline Active Directory (AD) compromise…