CVE-2025-55139: connect secure 22.7; +7 more affected products

Affected technology

connect secure · before 22.7 (exclusive)
ivanti

connect secure · 22.7
ivanti

connect secure · 22.7 · update r1
ivanti

connect secure · 22.7 · update r1.1
ivanti

connect secure · 22.7 · update r1.2
ivanti

connect secure · 22.7 · update r1.3
ivanti

connect secure · 22.7 · update r1.4
ivanti

connect secure · 22.7 · update r1.5
ivanti

connect secure · 22.7 · update r2
ivanti

connect secure · 22.7 · update r2.1
ivanti

connect secure · 22.7 · update r2.2
ivanti

connect secure · 22.7 · update r2.3
ivanti

connect secure · 22.7 · update r2.4
ivanti

connect secure · 22.7 · update r2.5
ivanti

connect secure · 22.7 · update r2.6
ivanti

connect secure · 22.7 · update r2.7
ivanti

connect secure · 22.7 · update r2.8
ivanti

policy secure · before 22.7 (exclusive)
ivanti

policy secure · 22.7
ivanti

policy secure · 22.7 · update r1
ivanti

policy secure · 22.7 · update r1.1
ivanti

policy secure · 22.7 · update r1.2
ivanti

policy secure · 22.7 · update r1.3
ivanti

policy secure · 22.7 · update r1.4
ivanti

policy secure · 22.7 · update r1.5
ivanti

zero trust access gateway · 22.8 · update r2.2
ivanti

neurons for secure access · before 22.8 (exclusive)
ivanti

neurons for secure access · 22.8 · update r1
ivanti

neurons for secure access · 22.8 · update r1.1
ivanti

neurons for secure access · 22.8 · update r1.2
ivanti

neurons for secure access · 22.8 · update r1.3
ivanti

Connect Secure · Exact affected versions not specified by the source
Ivanti

Policy Secure · Exact affected versions not specified by the source
Ivanti

ZTA Gateway · Exact affected versions not specified by the source
Ivanti

Neurons for Secure Access · Exact affected versions not specified by the source
Ivanti

Description’s affected range: before 22.7R2.9 or 22.8R2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

A remote authenticated attacker with admin privileges can enumerate internal services. Source advisory’s CVSS 3.1 assessment (base score 6.8/10) rates confidentiality impact as high; integrity and availability impact as none.