IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
8.8Alta

CVE-2026-12648

Ivanti Neurons for ITSM Publicada: (hace 2 meses)

Descripción

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

Debilidad (CWE): CWE-502

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
Ivanti Neurons for ITSM fixed 2026.2

Referencias y parches

Coincidencias CPE (NVD) (5)
  • cpe:2.3:a:ivanti:neurons_for_itsm:2025.2:*:*:*:*:*:*:*
  • cpe:2.3:a:ivanti:neurons_for_itsm:2025.3:*:*:*:*:*:*:*
  • cpe:2.3:a:ivanti:neurons_for_itsm:2025.4:*:*:*:*:*:*:*
  • cpe:2.3:a:ivanti:neurons_for_itsm:2026.1:*:*:*:*:*:*:*
  • cpe:2.3:a:ivanti:neurons_for_itsm:2026.2:*:*:*:*:*:*:*

CVE recientes del mismo producto — Ivanti (Connect Secure, EPMM…)

4.9Media
CVE-2026-83528
Ivanti Endpoint Manager Mobile

Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to leak GDPR protected user information.

5.5Media
CVE-2026-107405
Ivanti Endpoint Manager Mobile

An exposed dangerous function in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a local authenticated attacker to trigger a denial of service.

4.9Media
CVE-2026-107404
Ivanti Endpoint Manager Mobile

Argument injection in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk.

4.9Media
CVE-2026-105427
Ivanti Endpoint Manager Mobile

Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service.

6.7Media
CVE-2026-105426
Ivanti Endpoint Manager Mobile

Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root.

5.5Media
CVE-2026-123181
Ivanti Sentry

A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges.