CVE-2025-55145

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.9 Ivanti Policy Secure versions prior to 22.7R1.6 Ivanti ZTA Gateway versions prior to 2.8R2.3-723 Ivanti Neurons for Secure Access versions prior to 22.8R1.4

Description: A missing authorization flaw exists in the HTML5 session handling of Ivanti Connect Secure, Ivanti Policy Secure, Ivanti ZTA Gateway, and Ivanti Neurons for Secure Access. This allows a remote authenticated attacker to hijack existing HTML5 connections without proper authorization checks.

Recommendations: Ivanti Connect Secure versions prior to 22.7R2.9 should be updated. Ivanti Policy Secure versions prior to 22.7R1.6 should be updated. Ivanti ZTA Gateway versions prior to 2.8R2.3-723 should be updated. Ivanti Neurons for Secure Access versions prior to 22.8R1.4 should be updated.