CVE-2026-12650

HighCVSS 8.8/10Last modified Sep 18, 2026

Description

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Sep 8, 2026
Last modified: Sep 18, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-126518.8A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute CVE-2026-126545.3The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, CVE-2026-126558.8A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without v CVE-2026-126568.7A denial-of-service security issue exists in the affected product and version. The security issue stems from improper handling of network st CVE-2026-126575.3The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference i CVE-2026-126598.7A denial-of-service security issue exists in the affected products. The security issue stems from improper handling of exceptional condition CVE-2026-12664.4The Postalicious plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, CVE-2026-126602.7IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation.CVE-2026-126614.8A denial-of-service security issue exists within FactoryTalk® Historian Machine Edition. A network adjacent attacker who is authenticated c CVE-2026-126637.0A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation CVE-2026-126646.8GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 th CVE-2026-126659.8IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malforme