CVE-2025-55145: Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for…

Description

Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker to hijack existing HTML5 connections.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

High

Integrity

High

Availability

Low

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.7% · higher than 52% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

CS

Connect Secure · Ivanti

before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +11 more · source: NVD

NF

Neurons For Secure Access · Ivanti

before 22.8; 22.8; 22.8; 22.8; 22.8 · source: NVD

PS

Policy Secure · Ivanti

before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +2 more · source: NVD

ZT

Zero Trust Access Gateway · Ivanti

22.8 · source: NVD