CVE-2025-55146: An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for…

Description

An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to trigger a denial of service.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.8% · higher than 56% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

CS

Connect Secure · Ivanti

before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +11 more · source: NVD

NF

Neurons For Secure Access · Ivanti

before 22.8; 22.8; 22.8; 22.8; 22.8 · source: NVD

PS

Policy Secure · Ivanti

before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +2 more · source: NVD

ZT

Zero Trust Access Gateway · Ivanti

22.8 · source: NVD