Enterprise software vendor Ivanti has issued an emergency security bulletin detailing a critical remote code execution (RCE) flaw affecting on-premises deployments of Ivanti Neurons for ITSM (formerly known as HEAT Service Management). The vulnerability enables remote, unauthenticated adversaries to execute arbitrary commands at the highest system privilege level.

The flaw, designated as CVE-2026-12650, carries a Common Vulnerability Scoring System (CVSS v3.1/v4.0) base score of 9.8. Classified under CWE-502: Deserialization of Untrusted Data, the vulnerability resides in the backend integration endpoints responsible for processing asynchronous service request queues and automation scripts.

Vulnerability Mechanics: Binary Deserialization via Workflow Endpoints

According to technical disclosures published by Ivanti and coordinated vulnerability analysis teams, the issue stems from legacy .NET serialization handlers implemented in the AutomationService.svc and related web service interfaces. When processing incoming remote integration requests, the endpoint fails to validate object type restrictions prior to passing byte streams to binary formatters.

An attacker can construct a serialized .NET gadget chain—leveraging standard gadget patterns such as TypeConfuseDelegate or ActivitySurrogateSelector—and transmit it encapsulated in an HTTP POST request over port 443:

  1. Unauthenticated Access: The targeted API endpoint is exposed directly to incoming network traffic without enforcing pre-authentication authorization checks.
  2. Payload Ingestion: The web application server extracts the serialized stream and initializes deserialization routines without an explicit type binder whitelist.
  3. Arbitrary Execution: As the gadget executes during stream deserialization, arbitrary commands run under the context of the underlying worker process (w3wp.exe), inheriting complete administrative control over the host operating system.

IT Service Management (ITSM) platforms store Active Directory credentials, asset registries, ticketing histories, and automated deployment hooks. A remote code execution exploit against an ITSM gateway grants adversaries keys to the entire corporate kingdom.

Affected Versions & Deployment Matrix

Product Line Vulnerable Releases Fixed Version / Mitigation Remediation Urgency
Ivanti Neurons for ITSM (Cloud) All versions prior to 2026.3 Remediated automatically across global cloud clusters Completed
Ivanti Neurons for ITSM (On-Premises) 2023.4, 2024.1, 2024.2, 2024.3 Apply Hotfix 2024.3.1 or Release 2026.1 patch Immediate (24-Hour SLA)
Ivanti Voice / Contact Center Module Legacy builds linked to ITSM backend Apply Core ITSM Update + Voice Connector 8.4 Hotfix High

Incident Response & Forensic Detection Playbook

Enterprise defense teams managing on-premise Ivanti installations must immediately review web server telemetry and file integrity baselines. The following indicators and administrative checks should be executed across all application tiers:

# Verify installed assembly versions on Ivanti ITSM Web Servers
Get-ItemProperty -Path "C:Program FilesIvantiService ManagerAutomationIvanti.ITSM.Automation.dll" | 
    Select-Object -Property VersionInfo | 
    Format-List

# Audit IIS W3C Logs for suspicious POST requests to Automation endpoints
Get-ChildItem -Path "C:inetpublogsLogFilesW3SVC*" -Recurse | 
    Select-String -Pattern "AutomationService.svc|IntegrationService.asmx" | 
    Where-Object { $_ -match " 200 " -and $_ -match "POST" } | 
    Export-Csv -Path "C:Tempivanti_suspicious_requests.csv" -NoTypeInformation

Recommended Defensive Countermeasures

  • Install Vendor Security Updates: Download and apply the official Ivanti security patch for the exact minor build deployed within your environment.
  • Restrict Perimeter Exposure: Remove Neurons for ITSM administrative and automation ports from direct internet ingress. Require authenticated enterprise VPN or Zero Trust Network Access (ZTNA) gateways with hardware-bound MFA.
  • Web Application Firewall (WAF) Filtering: Implement protocol inspection rules blocking requests with serialized .NET signatures (e.g., matching byte sequences 00 01 00 00 00 FF FF FF FF or MIME types containing binary surrogate payloads).
  • Threat Hunting: Check for anomalous child processes spawned by w3wp.exe or the ITSM Workflow Service, specifically instances of cmd.exe, powershell.exe, certutil.exe, or outbound connections to unfamiliar external IP addresses.