Cyber Resilience

CVE-2026-4913

Medium

Published: 14 April 2026

Published
14 April 2026
Modified
17 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
EPSS Score 0.0013 31.4th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-4913 is a medium-severity Improper Protection of Alternate Path (CWE-424) vulnerability in Ivanti N-ITSM (inferred from references). Its CVSS base score is 5.7 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Local Accounts (T1078.003); ranked at the 31.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled.

CWE(s)
CWE-424

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1078.003 Local Accounts Stealth
Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
Why these techniques?

Vulnerability allows authenticated attacker to retain access via alternate path after account disablement, directly enabling continued use of local valid accounts.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

Affected Assets

Ivanti
N-ITSM
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-17 Remote Access
addresses: CWE-424

Documenting requirements and authorizing remote access ensures proper protection of alternate paths.

References