CVE-2025-55142

published 2025-09-09

CVE-2025-55142: Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and…

Priority P2 61 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
ivanti	connect_secure	< 22.7	22.7
ivanti	connect_secure	—	—
ivanti	neurons_for_secure_access	< 22.8	22.8
ivanti	neurons_for_secure_access	—	—
ivanti	policy_secure	< 22.7	22.7
ivanti	policy_secure	—	—
ivanti	zero_trust_access_gateway	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → Target products: Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723, and Ivanti Neurons for Secure Access before 22.8R1.4 are vulnerable to missing authorization (CWE-862) allowing read-only admin to modify authentication settings ↗
• → Audit for unexpected changes to authentication-related configuration made by accounts with read-only admin privileges — such changes should not be permitted and indicate exploitation of this missing authorization flaw ↗

• · Exploitation requires the attacker to already be authenticated with at least read-only admin privileges; unauthenticated exploitation is not possible ↗
• · Ivanti Neurons for Secure Access fix was deployed server-side on 02-Aug-2025 and may not require customer action, but all other affected products require patching to the fixed versions ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-862