Multiple Vulnerabilities Discovered in Ivanti Connect Secure, Policy Secure, and ZTA Gateways

According to Ivanti, six medium- and five high-severity vulnerabilities affect Ivanti Connect Secure, Policy Secure, ZTA Gateways and Neurons for Secure Access, with issues ranging from missing authorisation checks and CSRF flaws to SSRF and denial-of-service conditions.

The advisory lists affected versions including Ivanti Connect Secure 22.7R2.8 and earlier, Policy Secure 22.7R1.4 and earlier, ZTA Gateways 22.8R2.2, and Neurons for Secure Access 22.8R1.3 and earlier, and notes that Ivanti deployed fixes on 2 August 2025, with cloud updates for Neurons for Secure Access applied automatically. The CVEs include entries such as CVE-2025-8712, CVE-2025-55145, CVE-2025-55146, CVE-2025-55147, CVE-2025-55148 and others, with CVSS scores ranging to 8.9 for high-severity flaws.

Patches are available—Ivanti recommends updating to 22.7R2.9 or 22.8R2 for Connect Secure, 22.7R1.5 for Policy Secure, and 22.8R2.3-723 for ZTA Gateways—and administrators are urged to avoid exposing administrative portals to the internet. No evidence of customer exploitation has surfaced so far, and the article notes that security researchers, including Nikolay Semov, reported at least one CVE, with Ivanti thanking the researcher.