PT-2025-36748 · Ivanti · Ivanti Connect Secure+3

Published

2025-09-09

·

Updated

2025-09-24

·

CVE-2025-55145

CVSS v3.1

8.9

High

VectorAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.9 Ivanti Policy Secure versions prior to 22.7R1.6 Ivanti ZTA Gateway versions prior to 2.8R2.3-723 Ivanti Neurons for Secure Access versions prior to 22.8R1.4
Description: A missing authorization flaw exists in the HTML5 session handling of Ivanti Connect Secure, Ivanti Policy Secure, Ivanti ZTA Gateway, and Ivanti Neurons for Secure Access. This allows a remote authenticated attacker to hijack existing HTML5 connections without proper authorization checks.
Recommendations: Ivanti Connect Secure versions prior to 22.7R2.9 should be updated. Ivanti Policy Secure versions prior to 22.7R1.6 should be updated. Ivanti ZTA Gateway versions prior to 2.8R2.3-723 should be updated. Ivanti Neurons for Secure Access versions prior to 22.8R1.4 should be updated.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-55145

Affected Products

Ivanti Connect Secure
Ivanti Neurons For Secure Access
Ivanti Policy Secure
Ivanti Zta Gateways