CVE-2026-4914

28th percentile - higher than 28% of all known CVEs

Stored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain limited information from other user sessions. User interaction is required.

An attacker with a valid account could steal session data from other users, potentially leading to further privilege escalation or information leakage. The risk affects organizations running unpatched versions.

Update Ivanti N-ITSM to version 2025.4 or later. Additionally, consider implementing security headers and input validation.