What Is CVE-2026-9614 and Why Does It Matter?
Among the vulnerabilities disclosed in mid-2026, CVE-2026-9614 stands out as a serious authorization flaw in Ivanti Neurons for ITSM. Classified under CWE-284, it allows improper access control, meaning the system fails to verify whether a user holds administrative rights before granting privileged actions. A remote attacker with only low-level credentials can escalate to full admin access.
This matters because:
- Administrative control exposes tickets, configurations, and workflows
- Exploitation requires no authentication bypass, only valid low-privilege credentials
- Both cloud and on-premises deployments are affected
Its CVSS score of 8.8 confirms this as a high-severity threat demanding immediate action. The vulnerability carries a network attack vector with low complexity and no user interaction required, making it highly accessible to opportunistic attackers. The vulnerability was published on 02/06/2026, giving organizations a defined timeline from which to assess their exposure and prioritize remediation efforts. Organizations should evaluate their service management practices against ITIL guidelines to ensure proper role and workflow segregation.
Which Ivanti ITSM Versions Are Affected Right Now?
Understanding the severity of CVE-2026-9614 is only half the picture — knowing which specific versions carry the flaw determines whether an organization needs to act now.
On-premises deployments running 2025.4 or earlier are confirmed affected. Fixed builds include:
- 2025.4 Patch 1 (primary fix)
- 2025.3 Patch 1 (backport)
- 2025.2 Patch 1 (backport)
Cloud/SaaS tenants on 2026.1 or earlier were also exposed. Ivanti already pushed vendor-managed fixes on May 24–25, delivering 2026.1 Patch 9 and 2026.2 Patch 1.
On-premises customers must update manually through the Ivanti License System portal.
Cloud customers should confirm their tenant reflects the patched build. Ivanti also issued a secondary logging fix to address a separate bug affecting IP address tracking, which is unrelated to the core vulnerability. Organizations should also be aware that Ivanti’s broader product portfolio has faced significant scrutiny, with multiple critical CVEs disclosed in December 2024 affecting Cloud Services Appliance, Connect Secure, Policy Secure, and Sentry.
Organizations should also evaluate their data security posture to ensure patching is paired with strong protections for sensitive information.
How Does CVE-2026-9614 Turn a Low-Privilege Account Into Full Admin Access?
What makes CVE-2026-9614 particularly dangerous is not the complexity of the attack — it is the simplicity.
The flaw exists in how Ivanti ITSM validates user roles during privileged operations.
The server fails to confirm whether the caller actually holds administrative rights before executing restricted actions.
A low-privilege user submits requests normally reserved for administrators, and the platform processes them without challenge.
No phishing, no code execution, no additional foothold is required.
This kind of broken authorization mirrors issues seen in API-first integration where improper access controls can expose critical operations.
The result is direct, full administrative control over the ITSM environment — including roles, workflows, and system settings — gained entirely through broken authorization logic. This access extends to stored incident records, asset inventories, and integrations with downstream systems.
The vulnerability affects both cloud and on-premises deployments of Ivanti Neurons for ITSM, with fixed versions available across both environments.
Has CVE-2026-9614 Been Exploited : and Did Ivanti Already Patch Your Deployment?
So far, no authoritative source has confirmed that CVE-2026-9614 is being actively exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog. SentinelOne reports no known public exploits exist. The vulnerability carries a CVSS score of 8.8, placing it firmly in the high severity range.
No authoritative source has confirmed CVE-2026-9614 is actively exploited, and CISA has not added it to its KEV catalog.
Regarding patches, your situation depends on deployment type:
- Cloud: Ivanti automatically pushed fixes on May 24–25, 2026. No customer action is required.
- On-premises: No automatic update occurred. Administrators should ensure they have robust monitoring and governance in place to detect any suspicious activity.
Administrators must manually upgrade to one of these fixed versions:
- 2025.2 Patch 1 or later
- 2025.3 Patch 1 or later
- 2025.4 Patch 1 or later
Verify your on-premises version immediately.
Five Steps to Remediate CVE-2026-9614 on Your Ivanti ITSM Instance
Knowing that cloud deployments are already protected and on-premises instances are not, administrators running local installations face the most immediate risk from CVE-2026-9614.
Follow these five steps:
- Apply the branch-specific patch — install 2025.2 Patch 1, 2025.3 Patch 1, or 2025.4 Patch 1 matching your installed version.
- Restrict management interface access — enforce firewalls, VPNs, or IP allow-listing immediately.
- Audit roles and accounts — review administrator assignments and disable inactive accounts.
- Rotate credentials — reset service accounts, API keys, and integration secrets.
- Increase monitoring — review privileged action logs daily and expand audit log verbosity. Defenders should also be aware that Ivanti’s ICT has been confirmed insufficient to detect compromise, meaning elevated monitoring must not rely solely on built-in integrity checking tools.
Integrating ITSM with real-time data sharing across systems can help reduce detection and response times for incidents like this.
