CVE-2025-55146CWE-252

CVE-2025-55146

Medium · published September 9, 2025

CVSS v3.1
4.9
EPSS
1%
Percentile
56.0
In the wild
Unconfirmed
What it is

An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to trigger a denial of service.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00798 · 56.0th percentile
Weakness
CWE-252 · Unchecked Return Value
Published
2025-09-09T20:15Z
Affected products (31)
ProductVersionsFixed in
ivanti/connect_secure< 22.722.7
ivanti/connect_secureall versions—
ivanti/connect_secureall versions—
ivanti/connect_secureall versions—
ivanti/connect_secureall versions—
ivanti/connect_secureall versions—
ivanti/connect_secureall versions—
ivanti/connect_secureall versions—
ivanti/connect_secureall versions—
ivanti/connect_secureall versions—
ivanti/connect_secureall versions—
ivanti/connect_secureall versions—
ivanti/connect_secureall versions—
ivanti/connect_secureall versions—
ivanti/connect_secureall versions—
ivanti/connect_secureall versions—
ivanti/connect_secureall versions—
ivanti/policy_secure< 22.722.7
ivanti/policy_secureall versions—
ivanti/policy_secureall versions—
ivanti/policy_secureall versions—
ivanti/policy_secureall versions—
ivanti/policy_secureall versions—
ivanti/policy_secureall versions—
ivanti/policy_secureall versions—
ivanti/zero_trust_access_gatewayall versions—
ivanti/neurons_for_secure_accessall versions—
ivanti/neurons_for_secure_accessall versions—
ivanti/neurons_for_secure_access< 22.822.8
ivanti/neurons_for_secure_accessall versions—
ivanti/neurons_for_secure_accessall versions—
References (1)
https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US · 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
EPSS history
Timeline
  • 09 SEP 15:28Z
    An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and…
    cvelistv5