Quick Look: CVE-2026-9614 Privilege Escalation in Ivanti Neurons for ITSM

Introduction

On June 1, 2026, Ivanti released an out-of-band emergency patch for a privilege escalation flaw in Ivanti Neurons for ITSM. The flaw lets any authenticated user, even one with the lowest level of access, promote themselves to full administrator. For organizations running on-premises deployments, the window between disclosure and patch application is a period of significant exposure, given Ivanti's well-documented history of rapid post-disclosure exploitation across its product portfolio.

Ivanti Neurons for ITSM is a service management platform that enterprises use to manage IT service desks, incident workflows, configuration items, and asset records. In the ITSM market, Ivanti competes with ServiceNow (which holds 44.4% market share), Atlassian, and BMC Software. The platform holds a 4.2-star rating across 1,333 reviews on Gartner Peer Insights. Administrative access to an ITSM platform like this gives control over enterprise service management workflows, user data, and configuration records, and that control makes the platform a high-value target for attackers.

Technical information

Root cause: Improper Access Control (CWE-284)

CVE-2026-9614 is classified under CWE-284 (Improper Access Control), which MITRE defines as occurring when "the product does not restrict or incorrectly restricts access to a resource from an unauthorized actor." MITRE notes that CWE-284 is a broad category that covers more specific child weaknesses, including privilege escalation, insecure direct object references, and session management flaws. MITRE discourages direct use of CWE-284 in favor of its more specific child CWEs, which suggests the precise mechanism falls under a narrower subcategory such as CWE-269 (Improper Privilege Management) or CWE-639 (Authorization Bypass Through User Controlled Key).

The vulnerability affects both cloud and on-premises deployments of Ivanti Neurons for ITSM, which points to a flaw in the application logic layer rather than in deployment-specific infrastructure.

CVSS v3.1 vector analysis

The full CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which gives a base score of 8.8 (High).

Together, PR:L and AC:L mean that any user with basic authentication credentials, whether a low-privilege service desk agent, an end user with a self-service portal login, or any other non-administrative role, could elevate their access to full administrator. In a typical ITSM deployment with hundreds or thousands of authenticated users, that is a large attack surface.

Attack flow

Based on the advisory details and the CVSS vector, exploitation follows this sequence:

1. Authentication: The attacker needs valid credentials for the ITSM application. This could be a low-privilege account, such as a standard service desk user, an end user with self-service portal access, or any other non-administrative role. The credentials could come from a legitimate employee account, from phishing or credential stuffing, or from an insider.

2. Access control bypass: Once authenticated, the attacker exploits the improper access control flaw to escalate to full administrator. Given the CWE-284 classification and the "low complexity" rating, this likely involves directly accessing administrative functions or API endpoints that lack proper authorization checks, rather than complex chaining or race conditions.

3. Full administrative compromise: With administrative access, the attacker has complete control over the ITSM platform. They can view, modify, or delete all service management data, create or modify user accounts and permissions, access configuration items and asset records, and alter workflows and automation rules.

Ivanti released this patch out of band and cited the "simplicity of exploitation" as the reason for the urgency. That reinforces the reading that the technique is straightforward once an attacker has any level of authenticated access. Exploiting it does not take sophisticated tooling or deep product knowledge.

Strategic impact

In practice, an attacker with admin control over Ivanti Neurons for ITSM could:

• Exfiltrate sensitive incident data and configuration records
• Create persistent backdoor accounts
• Modify workflows to redirect approvals or suppress alerts
• Use the platform as a pivot point for lateral movement across the enterprise
• Disrupt IT service operations by altering or deleting critical service management configurations

Patch information

Ivanti released an out-of-band emergency patch for CVE-2026-9614 on June 1, 2026, citing elevated risk from the simplicity of exploitation. The fix addresses the Improper Access Control flaw in Ivanti Neurons for ITSM that allowed a remote authenticated attacker to escalate privileges to full administrator access.

Ivanti handled the two deployment models differently.

On-premises deployments

Ivanti backported the fix to the three most recent release branches. On-premises administrators must manually download and apply one of the following patched versions from the Ivanti License System (ILS) Downloads portal:

The patch will not apply itself. On-premises customers must obtain and deploy it.

Cloud (SaaS) deployments

Ivanti applied the security fix to all cloud tenant landscapes on May 24 and May 25, 2026, a full week before public disclosure. The remediated cloud versions are 2026.1 Patch 9 and 2026.2 Patch 1.

Cloud customers do not need to take any action. Ivanti confirmed the fix has already been applied across all cloud environments.

Post-patch note for cloud administrators

Shortly after deploying the security fix on cloud tenants, Ivanti released a follow-on patch (2026.1 Patch 10 and 2026.2 Patch 2) that corrected a separate regression bug where IP addresses were not being logged properly. This logging issue only affects the cloud version and was not part of the CVE-2026-9614 fix itself, but cloud administrators reviewing their recent patching timeline should know about it.

External advisories

The Canadian Centre for Cyber Security independently issued advisory AV26-533 on June 1, 2026. It confirms the affected product versions and directs organizations to apply Ivanti's updates immediately. NVD published its entry for CVE-2026-9614 the same day, with Ivanti's security advisory as its sole primary source.

Workaround (if patching is delayed)

For organizations that cannot patch immediately, Ivanti advises auditing role configurations so that permissions are strictly limited to intended administrative roles. Specific actions include:

• Review all user accounts and role assignments in Ivanti Neurons for ITSM, and remove unnecessary privileges
• Enforce the principle of least privilege, so that service desk agents, end users, and other non-admin roles have only the minimum permissions they need
• Monitor administrative access logs for unusual privilege escalation activity, or for access by accounts that should not have admin-level permissions
• Restrict network access to the ITSM application where possible, to limit the pool of authenticated users who could exploit the vulnerability
• Implement multi-factor authentication to reduce the risk that compromised credentials lead to authenticated access
• Use network segmentation to limit ITSM exposure to authorized internal networks
• Enable detailed access logging, and configure SIEM alerts for anomalous admin-level actions performed by non-admin accounts

Affected systems and versions

On-premises deployments: All on-premises versions of Ivanti Neurons for ITSM up to and including version 2025.4 are vulnerable. This covers the 2025.2.x, 2025.3.x, and 2025.4 release branches, as well as any earlier versions.

Cloud (SaaS) deployments: All cloud versions up to and including 2026.1 (prior to Patch 9) and 2026.2 (prior to Patch 1) were affected. Ivanti remediated these automatically on May 24 and 25, 2026.

Fixed versions:

SaaS customers have been protected since May 24 and 25. On-premises deployments stay vulnerable until an administrator applies the patch by hand, so organizations running on-premises Ivanti Neurons for ITSM should treat patching as an emergency operation rather than a scheduled maintenance item.

Vendor security history

Ivanti has faced a recurring pattern of critical security vulnerabilities across multiple product lines from 2024 to 2026. Several have been actively exploited in the wild and added to the CISA Known Exploited Vulnerabilities catalog.

China-nexus threat actors have been linked to exploitation of Ivanti Connect Secure vulnerabilities going back to December 2023, and CISA issued emergency directives. Attackers exploited the EPMM zero-days (CVE-2026-1281 and CVE-2026-1340) before patches were available, with widespread web shell deployment and credential harvesting. In February 2026, CISA issued an updated analysis of the RESURGE malware, a stealthy, active threat linked to Ivanti compromise that can stay dormant inside compromised environments.

Neurons for ITSM has no confirmed in-the-wild exploitation yet, but the precedent set by other Ivanti products warrants heightened vigilance. Threat actors who have invested in Ivanti exploitation tooling may turn their attention to the ITSM platform, especially given the administrative access this CVE provides.

Ivanti has stated it is not aware of active exploitation of CVE-2026-9614 before disclosure. Even so, the low exploitation complexity and Ivanti's track record of rapid weaponization make post-disclosure exploitation a realistic concern. After remediation, organizations should review administrative access logs for the window between disclosure (June 1, 2026) and patch application. Any exploitation would show up as non-admin accounts performing admin-level operations.

References

• Ivanti Security Advisory: CVE-2026-9614
• NVD: CVE-2026-9614
• Canadian Centre for Cyber Security Advisory AV26-533
• CWE-284: Improper Access Control
• CWE-264: Permissions, Privileges, and Access Controls
• CISA Known Exploited Vulnerabilities Catalog
• Unit 42: Critical Vulnerabilities in Ivanti EPMM Exploited
• Rapid7: Ivanti Connect Secure CVE-2025-22457 Exploited in the Wild
• Cybersecurity Dive: CISA Adds Second Critical Flaw in Ivanti EPMM to Exploited List
• SecurityWeek: Two Vulnerabilities Patched in Ivanti Neurons for ITSM
• CISA: Updated RESURGE Malware Analysis
• Cybersecurity Dive: CISA Adds Ivanti Connect Secure Vulnerability to KEV Catalog
• Ivanti Security Advisory Blog
• Ivanti (Wikipedia)