Ivanti N-ITSM Imp. PS of Alt Path before 2025.4: Auth Retains Access w/ Disabled Acc: CVE-2026-4913 April 2026

Ivanti N-ITSM Imp. PS of Alt Path before 2025.4: Auth Retains Access w/ Disabled Acc
CVE-2026-4913 Published on April 14, 2026

Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled.

Vulnerability Analysis

CVE-2026-4913 can be exploited with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

LOW

User Interaction:

REQUIRED

Scope:

UNCHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

NONE

Availability Impact:

NONE

Weakness Type

Improper Protection of Alternate Path

The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.

Products Associated with CVE-2026-4913

Want to know whenever a new CVE is published for Ivanti Neurons For Itsm? stack.watch will email you.

Affected Versions