PT-2025-36746 · Ivanti · Ivanti Connect Secure+3
CVE-2025-55141
·
Published
2025-09-09
·
Updated
2025-09-09
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Ivanti Connect Secure versions prior to 22.7R2.9
Ivanti Policy Secure versions prior to 22.7R1.6
Ivanti ZTA Gateway versions prior to 2.8R2.3-723
Ivanti Neurons for Secure Access versions prior to 22.8R1.4
Description:
A missing authorization flaw allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.
Recommendations:
Ivanti Connect Secure versions prior to 22.7R2.9 should be updated.
Ivanti Policy Secure versions prior to 22.7R1.6 should be updated.
Ivanti ZTA Gateway versions prior to 2.8R2.3-723 should be updated.
Ivanti Neurons for Secure Access versions prior to 22.8R1.4 should be updated.
Fix
LPE
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ivanti Connect Secure
Ivanti Neurons For Secure Access
Ivanti Policy Secure
Ivanti Zta Gateways