CVE-2026-4913

Medium

Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access…

ivanti·CWE-424·Published 2026-04-14

CVSS

5.7

EPSS

0.01

KEV

Exploits

cve.orgen

173 chars

Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled.

NVDen

173 chars

Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled.

Protección inadecuada de una ruta alternativa en Ivanti N-ITSM antes de la versión 2025.4 permite a un atacante remoto autenticado retener el acceso cuando su cuenta ha sido deshabilitada.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	5.7	—	—	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
3.1	Secondary	NVD	5.7	2.1	3.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N