CVE-2025-55147

published 2025-09-09

CVE-2025-55147: CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for…

Priority P3 54 high 8.8 CVSS 3.1

AV N AC L PR N UI R S U C H I H A H

CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to execute sensitive actions on behalf of the victim user. User interaction is required

Affected

7 ranges

Vendor	Product	Version range	Fixed in
ivanti	connect_secure	< 22.7	22.7
ivanti	connect_secure	—	—
ivanti	neurons_for_secure_access	< 22.8	22.8
ivanti	neurons_for_secure_access	—	—
ivanti	policy_secure	< 22.7	22.7
ivanti	policy_secure	—	—
ivanti	zero_trust_access_gateway	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-352