CVE-2025-55141: High severity Ivanti Connect Secure vulnerability

Q: What is the severity of CVE-2025-55141?

CVE-2025-55141 is considered a high severity vulnerability due to missing authorization which can be exploited by authenticated attackers.

Q: How do I fix CVE-2025-55141?

To fix CVE-2025-55141, upgrade to Ivanti Connect Secure 22.7R2.9, Ivanti Policy Secure 22.7R1.6, Ivanti ZTA Gateway 2.8R2.3-723, or Ivanti Neurons for Secure Access 22.8R1.4.

Q: What products are affected by CVE-2025-55141?

CVE-2025-55141 affects Ivanti Connect Secure, Ivanti Policy Secure, Ivanti ZTA Gateway, and Ivanti Neurons for Secure Access.

Q: What kind of attacks can CVE-2025-55141 enable?

CVE-2025-55141 may allow a remote authenticated attacker to gain unauthorized access to sensitive information and perform actions with read-only admin privileges.

Q: When was the fix for CVE-2025-55141 deployed?

The fix for CVE-2025-55141 was deployed on August 2, 2025.

Published Sep 9, 2025

Updated

Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.

Affected Software

35 affected components

Ivanti Connect Secure<22.7R2.9, <22.8R2

Ivanti Policy Secure<22.7R1.6

Ivanti ZTA Gateway<2.8R2.3-723

Ivanti Neurons for Secure Access<22.8R1.4

Ivanti Connect Secure<22.7

Ivanti Connect Secure=22.7

Ivanti Connect Secure=22.7-r1

Ivanti Connect Secure=22.7-r1.1

Ivanti Connect Secure=22.7-r1.2

Ivanti Connect Secure=22.7-r1.3

Ivanti Connect Secure=22.7-r1.4

Ivanti Connect Secure=22.7-r1.5

Ivanti Connect Secure=22.7-r2

Ivanti Connect Secure=22.7-r2.1

Ivanti Connect Secure=22.7-r2.2

Ivanti Connect Secure=22.7-r2.3

Ivanti Connect Secure=22.7-r2.4

Ivanti Connect Secure=22.7-r2.5

Ivanti Connect Secure=22.7-r2.6

Ivanti Connect Secure=22.7-r2.7

Ivanti Connect Secure=22.7-r2.8

Ivanti Policy Secure<22.7

Ivanti Policy Secure=22.7

Ivanti Policy Secure=22.7-r1

Ivanti Policy Secure=22.7-r1.1

Ivanti Policy Secure=22.7-r1.2

Ivanti Policy Secure=22.7-r1.3

Ivanti Policy Secure=22.7-r1.4

Ivanti Policy Secure=22.7-r1.5

Ivanti Zero Trust Access Gateway=22.8-r2.2

Ivanti Neurons for Secure Access<22.8

Ivanti Neurons for Secure Access=22.8-r1

Ivanti Neurons for Secure Access=22.8-r1.1

Ivanti Neurons for Secure Access=22.8-r1.2

Ivanti Neurons for Secure Access=22.8-r1.3

Event History

Sep 9, 2025

CVE Published

via MITRE·03:45 PM

Data Sourced

via MITRE·03:45 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-55141?

CVE-2025-55141 is considered a high severity vulnerability due to missing authorization which can be exploited by authenticated attackers.

How do I fix CVE-2025-55141?

To fix CVE-2025-55141, upgrade to Ivanti Connect Secure 22.7R2.9, Ivanti Policy Secure 22.7R1.6, Ivanti ZTA Gateway 2.8R2.3-723, or Ivanti Neurons for Secure Access 22.8R1.4.

What products are affected by CVE-2025-55141?

CVE-2025-55141 affects Ivanti Connect Secure, Ivanti Policy Secure, Ivanti ZTA Gateway, and Ivanti Neurons for Secure Access.

What kind of attacks can CVE-2025-55141 enable?

CVE-2025-55141 may allow a remote authenticated attacker to gain unauthorized access to sensitive information and perform actions with read-only admin privileges.

When was the fix for CVE-2025-55141 deployed?