CVE-2026-4913

MediumCVSS 5.7

Published: 14/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.59%

48th percentile - higher than 48% of all known CVEs

Summary

Ivanti N-ITSM before version 2025.4 improperly protects an alternate path, allowing a remote authenticated attacker to retain access after their account has been disabled.

Risk Assessment

This could let former employees or attackers with compromised accounts maintain access, violating access control.

Recommendation

Update Ivanti N-ITSM to version 2025.4 or later and verify that disabled accounts have no active sessions.

Other vulnerabilities in Ivanti N-ITSM

CVE-2026-4914Medium
Stored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain limited information from other user sessions. User interaction is required.

Original NVD description (English source)

Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS