Ivanti Neurons ITSM Vulnerabilities Could Allow Session Persistence

Why It Matters

The flaws threaten persistent unauthorized access to critical ITSM workflows, potentially compromising service continuity and sensitive operational data. Prompt patching is essential to safeguard enterprise service desks and maintain compliance with security standards.

Key Takeaways

• CVE-2026-4913 enables session persistence after account deactivation
• CVE-2026-4914 is a stored XSS exposing session data
• Affected Ivanti Neurons ITSM versions ≤2025.3; patch in 2025.4
• Cloud users auto‑patched Dec 12 2025; on‑premises must update manually
• No evidence of active exploitation as of April 14 2026

Pulse Analysis

Ivanti’s Neurons platform powers the service desks of thousands of midsize and enterprise organizations, making its security posture a bellwether for the broader ITSM market. As digital workflows become increasingly automated, attackers target the thin line between user authentication and session management. The newly disclosed CVE‑2026‑4913 and CVE‑2026‑4914 illustrate how even medium‑scored vulnerabilities can create footholds for persistent threats, especially in environments where privileged accounts manage incident response and change control.

The technical nuance of CVE‑2026‑4913 lies in an alternate‑path flaw that bypasses standard session termination, allowing a disabled account to continue interacting with the system. Meanwhile, CVE‑2026‑4914 leverages stored cross‑site scripting to inject malicious scripts that execute in other users’ browsers, potentially leaking configuration details or internal ticket data. Both issues require an authenticated foothold, but once achieved they can undermine the integrity of service management processes, erode trust in ticketing data, and expose organizations to downstream attacks on connected tools.

Ivanti’s rapid release of version 2025.4, with automatic remediation for cloud deployments and a clear manual upgrade path for on‑premises installations, demonstrates a proactive response that aligns with industry best practices. Security teams should verify patch adoption, review session handling policies, and monitor for anomalous activity that could indicate exploitation attempts. As the ITSM ecosystem continues to integrate AI‑driven analytics and third‑party plugins, maintaining a hardened session lifecycle will be critical to preventing similar persistence vectors in future releases.