Ivanti Neurons for Secure Access
13 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2025-55144 | fixed in 22.8R1.4 (Fix deployed on 02-Aug-2025) | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2. | MEDIUM 5.4 | 0.6 % | ||
| CVE-2025-55143 | fixed in 22.8R1.4 (Fix deployed on 02-Aug-2025) | Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before | MEDIUM 6.1 | 0.7 % | ||
| CVE-2025-55142 | fixed in 22.8R1.4 (Fix deployed on 02-Aug-2025) | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2. | HIGH 8.8 | 1.0 % | ||
| CVE-2025-55141 | fixed in 22.8R1.4 (Fix deployed on 02-Aug-2025) | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2. | HIGH 8.8 | 1.0 % | ||
| CVE-2025-55139 | fixed in 22.8R1.4 (Fix deployed on 02-Aug-2025) | SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Iva | MEDIUM 6.8 | 0.9 % | ||
| CVE-2025-55148 | fixed in 22.8R1.4 (Fix deployed on 02-Aug-2025) | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2. | HIGH 7.6 | 0.6 % | ||
| CVE-2025-55147 | fixed in 22.8R1.4 (Fix deployed on 02-Aug-2025) | CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Iva | HIGH 8.8 | 0.6 % | ||
| CVE-2025-55146 | fixed in 22.8R1.4 (Fix deployed on 02-Aug-2025) | An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway befor | MEDIUM 4.9 | 0.8 % | ||
| CVE-2025-55145 | fixed in 22.8R1.4 (Fix deployed on 02-Aug-2025) | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2. | HIGH 8.9 | 0.7 % | ||
| CVE-2025-8712 | fixed in 22.8R1.4 (Fix deployed on 02-Aug-2025) | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22 | MEDIUM 5.4 | 0.5 % | ||
| CVE-2025-5468 | fixed in 22.8R1.4 (Fix deployed on 02-Aug-2025) | Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti | MEDIUM 5.5 | 0.4 % | ||
| CVE-2025-5466 | fixed in 22.8R1.4 (Fix deployed on 02-Aug-2025) | XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Iva | MEDIUM 4.9 | 0.7 % | ||
| CVE-2025-5462 | fixed in 22.8R1.4 (Fix deployed on 02-Aug-2025) | A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway be | HIGH 7.5 | 1.1 % |