CVE-2025-55143

published 2025-09-09

CVE-2025-55143: Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and…

Priority P3 37 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to inject arbitrary text into a crafted HTTP response. User interaction is required.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
ivanti	connect_secure	< 22.7	22.7
ivanti	connect_secure	—	—
ivanti	neurons_for_secure_access	< 22.8	22.8
ivanti	neurons_for_secure_access	—	—
ivanti	policy_secure	< 22.7	22.7
ivanti	policy_secure	—	—
ivanti	zero_trust_access_gateway	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79