Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled.
| Vendor | Product | Versions |
|---|---|---|
| ivanti | n-itsm | — |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| ivanti | neurons for itsm | cert_advisory | 90% |
Updated severity to HIGH, CVSS score to 7.5, and marked exploit as available and actively exploited.
Added affected version 2025.3 and confirmed no exploit is available.
Initial creation
