- Ivanti released a patch for a critical difficulty error in neurons for ITSM
- The error can be abused to get administrator privileges on target systems
- There is no evidence of abuse in nature
Ivanti has patched a vulnerability of critical difficulty in its neurons for ITSM IT service management solution and encourages users to use the fix and mitigate the risk as soon as possible.
Neurons for ITSM are an AI-driven IT Service Management Platform used by IT departments in the middle of large companies to automate, streamline and manage IT support services, events and assets across their organizations.
An exact number of users is unknown, but Ivanti claims to be service tens of thousands of organizations with its portfolio, so it is safe to assume that the attack surface is relatively large.
Attacks with low complexity
The vulnerability in question is traced as CVE-2025-22462. NVD describes it as an authentication compass in neurons for ITSM in versions before 2023.4, 2024.2 and 2024.3 with security-oriented May 2025. It only affects on-prema cases and provides a remote unauthorized threat actor to get administrator rights on the target system.
The company says that depending on the system configuration, vulnerability can be utilized in low complexity attacks. However, it does not appear to have happened yet, as Ivanti claims that there is no evidence of abuse in nature so far.
Ivanti also suggested that organizations follow its guidance as they will be less exposed to potential attacks.
“Customers who have followed Ivanti’s guidance on securing the IIS website and limited access to a limited number of IP addresses and domain names have a reduced risk to their environment,” the company said in advice. “Customers who have users log in to the solution outside their corporate network also has a reduced risk to their environment if they ensure the solution is configured with a DMZ.”
This is the second major vulnerability Ivanti patched this week, after addressing a critical difficulty error in its Endpoint Manager Mobile (EPMM) software.
Via Bleeping computer
