An Improper Access Control vulnerability in Ivanti Neurons for ITSM

CVE-2026-9614 is an authorization failure in Ivanti Neurons for ITSM that lets a remote authenticated low-privilege user reach admin-only functionality and end up with administrative access. Authoritative version data shows the affected ranges are On-Premises default-affected until 2025.2 Patch 1 / 2025.3 Patch 1 / 2025.4 Patch 1 and Cloud default-affected until 2026.1 Patch 9 / 2026.2 Patch 1. Ivanti’s SaaS service was already remediated on May 24–25, 2026, so the remaining customer-owned risk is mainly on on-prem deployments.

The vendor’s 8.8 HIGH score is technically understandable because the end state is full admin inside the ITSM app, but it overstates fleet-wide urgency. The biggest real-world friction is PR:L: the attacker needs a valid account first, which means theft of employee/helpdesk credentials, insider abuse, or an earlier compromise stage. That changes this from an internet-first breach path into a post-auth privilege escalation, and the very low EPSS 0.00363 plus no KEV / no reported exploitation pushes it down another notch.

Why this verdict

• Start from 8.8, then tax PR:L hard — a low-priv authenticated bug is already post-login. In enterprise reality that means stolen user creds, insider misuse, or earlier foothold, so I pull the score down materially from the vendor baseline.
• Most of the cloud population is already gone — Ivanti states SaaS remediation landed on May 24–25, 2026. That collapses the reachable population to customers still running vulnerable on-prem builds.
• No exploitation pressure is visible — EPSS 0.00363, no KEV, and no public PoC all argue against urgent attacker demand right now.

Why not higher?

If this were unauthenticated or broadly proven internet-exploitable with active campaigns, it would stay HIGH or go higher because admin inside an ITSM platform can be ugly. But the need for valid credentials is not a footnote; it is the main real-world gate, and the cloud estate has already been centrally fixed.

Why not lower?

Once exploited, the attacker can become ITSM admin, which is enough to tamper workflows, approvals, users, integrations, and sensitive ticketing data. That is too much operational leverage to treat as LOW or backlog-only hygiene, especially in shops where ITSM is tied to identity, automation, or change-control systems.

1. Constrain who can log in — Reduce the population that can even reach the vulnerable code path: restrict ITSM access to named groups, VPN, managed devices, and conditional-access compliant sessions. For a MEDIUM verdict there is no noisgate mitigation SLA; deploy this now as hygiene while you schedule patching inside the 365-day remediation window.
2. Review low-priv role grants — Audit self-service, analyst, contractor, and dormant accounts for unnecessary access to admin-adjacent modules and APIs. Ivanti-linked guidance reviewed by CERT Santé also points to role/permission review as a useful stopgap; with no mitigation SLA for MEDIUM, do this during your next access-governance cycle, not as an emergency war room.
3. Alert on admin actions by non-admin identities — Create SIEM detections for role elevation, new admin creation, workflow edits, integration-key creation, and admin API use where the actor was previously low privilege. This is your best tripwire because network signatures are weak against authenticated business-logic abuse.
4. Put the app behind stronger session controls — Reinforce SSO, MFA, step-up auth for admin paths, IP/device restrictions, and short session lifetime for elevated roles. This does not fix the bug, but it raises the cost of the credential acquisition stage that the attacker must satisfy first.

Run this on an auditor workstation or target Windows app server to evaluate known Ivanti ITSM version data; it does not exploit the bug and needs no admin rights. Invoke it like powershell -ExecutionPolicy Bypass -File .\check-cve-2026-9614.ps1 -Deployment OnPrem -Version 2025.4 -Patch 0 or powershell -ExecutionPolicy Bypass -File .\check-cve-2026-9614.ps1 -Deployment Cloud -Version 2026.1 -Patch 9.

# check-cve-2026-9614.ps1

# Version compliance checker for CVE-2026-9614

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


[CmdletBinding()]
param(
    [Parameter(Mandatory=$true)]
    [ValidateSet('OnPrem','Cloud')]
    [string]$Deployment,

    [Parameter(Mandatory=$true)]
    [string]$Version,

    [Parameter(Mandatory=$false)]
    [int]$Patch = 0
)

function Write-Result {
    param(
        [string]$State,
        [string]$Reason,
        [int]$Code
    )
    Write-Output ("{0} - {1}" -f $State, $Reason)
    exit $Code
}

function Parse-Version {
    param([string]$InputVersion)
    if ($InputVersion -match '^(\d{4})\.(\d+)$') {
        return [PSCustomObject]@{
            Year  = [int]$matches[1]
            Minor = [int]$matches[2]
        }
    }
    return $null
}

$v = Parse-Version -InputVersion $Version
if (-not $v) {
    Write-Result -State 'UNKNOWN' -Reason "Could not parse version '$Version'. Use forms like 2025.4 or 2026.1." -Code 2
}

if ($Deployment -eq 'OnPrem') {
    # Authoritative fixed versions from CVE/OpenCVE/CERT-FR:

    # 2025.2 Patch 1, 2025.3 Patch 1, 2025.4 Patch 1 are unaffected.


    if ($v.Year -lt 2025) {
        Write-Result -State 'VULNERABLE' -Reason 'On-prem version predates all listed fixed trains; treat as affected.' -Code 1
    }

    if ($v.Year -gt 2025) {
        Write-Result -State 'PATCHED' -Reason 'On-prem version is newer than the listed vulnerable trains.' -Code 0
    }

    switch ($v.Minor) {
        2 {
            if ($Patch -ge 1) { Write-Result -State 'PATCHED' -Reason '2025.2 Patch 1 or later is fixed.' -Code 0 }
            else { Write-Result -State 'VULNERABLE' -Reason '2025.2 before Patch 1 is affected.' -Code 1 }
        }
        3 {
            if ($Patch -ge 1) { Write-Result -State 'PATCHED' -Reason '2025.3 Patch 1 or later is fixed.' -Code 0 }
            else { Write-Result -State 'VULNERABLE' -Reason '2025.3 before Patch 1 is affected.' -Code 1 }
        }
        4 {
            if ($Patch -ge 1) { Write-Result -State 'PATCHED' -Reason '2025.4 Patch 1 or later is fixed.' -Code 0 }
            else { Write-Result -State 'VULNERABLE' -Reason '2025.4 before Patch 1 is affected.' -Code 1 }
        }
        default {
            if ($v.Minor -lt 2) {
                Write-Result -State 'VULNERABLE' -Reason '2025.x earlier than 2025.2 is older than all fixed on-prem trains; treat as affected.' -Code 1
            }
            else {
                Write-Result -State 'PATCHED' -Reason '2025.x newer than 2025.4 is not in the listed affected trains.' -Code 0
            }
        }
    }
}
elseif ($Deployment -eq 'Cloud') {
    # Authoritative unaffected cloud builds:

    # 2026.1 Patch 9 and 2026.2 Patch 1

    # Note: Ivanti says SaaS remediation was already deployed on 2026-05-24 and 2026-05-25.


    if ($v.Year -lt 2026) {
        Write-Result -State 'VULNERABLE' -Reason 'Cloud version predates all listed fixed trains; treat as affected unless vendor confirms tenant remediation.' -Code 1
    }

    if ($v.Year -gt 2026) {
        Write-Result -State 'PATCHED' -Reason 'Cloud version is newer than the listed vulnerable trains.' -Code 0
    }

    switch ($v.Minor) {
        1 {
            if ($Patch -ge 9) { Write-Result -State 'PATCHED' -Reason '2026.1 Patch 9 or later is fixed.' -Code 0 }
            else { Write-Result -State 'VULNERABLE' -Reason '2026.1 before Patch 9 is affected.' -Code 1 }
        }
        2 {
            if ($Patch -ge 1) { Write-Result -State 'PATCHED' -Reason '2026.2 Patch 1 or later is fixed.' -Code 0 }
            else { Write-Result -State 'VULNERABLE' -Reason '2026.2 before Patch 1 is affected.' -Code 1 }
        }
        default {
            Write-Result -State 'UNKNOWN' -Reason 'Cloud train not explicitly covered by reviewed advisory data; verify with Ivanti tenant release notes.' -Code 2
        }
    }
}
else {
    Write-Result -State 'UNKNOWN' -Reason 'Unsupported deployment type.' -Code 2
}

Sources

1. Ivanti blog: June 2026 Ivanti Neurons for ITSM Security Update
2. NVD record for CVE-2026-9614
3. OpenCVE detail page with affected/fixed versions and EPSS
4. CERT-FR advisory for Ivanti products
5. CERT Santé summary for CVE-2026-9614
6. Canadian Centre for Cyber Security advisory AV26-533
7. CISA Known Exploited Vulnerabilities Catalog
8. runZero asset-finding guidance for Ivanti Neurons for ITSM