CVE-2025-55145: neurons for secure access before 22.8 (exclusive), 22.8 · update r1, 22.8 · update r1.1 (+2 more affected versions)…

Affected technology

neurons for secure access · before 22.8 (exclusive)
ivanti

neurons for secure access · 22.8 · update r1
ivanti

neurons for secure access · 22.8 · update r1.1
ivanti

neurons for secure access · 22.8 · update r1.2
ivanti

neurons for secure access · 22.8 · update r1.3
ivanti

connect secure · before 22.7 (exclusive)
ivanti

connect secure · 22.7
ivanti

connect secure · 22.7 · update r1
ivanti

connect secure · 22.7 · update r1.1
ivanti

connect secure · 22.7 · update r1.2
ivanti

connect secure · 22.7 · update r1.3
ivanti

connect secure · 22.7 · update r1.4
ivanti

connect secure · 22.7 · update r1.5
ivanti

connect secure · 22.7 · update r2
ivanti

connect secure · 22.7 · update r2.1
ivanti

connect secure · 22.7 · update r2.2
ivanti

connect secure · 22.7 · update r2.3
ivanti

connect secure · 22.7 · update r2.4
ivanti

connect secure · 22.7 · update r2.5
ivanti

connect secure · 22.7 · update r2.6
ivanti

connect secure · 22.7 · update r2.7
ivanti

connect secure · 22.7 · update r2.8
ivanti

policy secure · before 22.7 (exclusive)
ivanti

policy secure · 22.7
ivanti

policy secure · 22.7 · update r1
ivanti

policy secure · 22.7 · update r1.1
ivanti

policy secure · 22.7 · update r1.2
ivanti

policy secure · 22.7 · update r1.3
ivanti

policy secure · 22.7 · update r1.4
ivanti

policy secure · 22.7 · update r1.5
ivanti

zero trust access gateway · 22.8 · update r2.2
ivanti

Connect Secure 22.7R2.9 · Exact affected versions not specified by the source
Ivanti

Policy Secure · Exact affected versions not specified by the source
Ivanti

ZTA Gateway · Exact affected versions not specified by the source
Ivanti

Neurons for Secure Access · Exact affected versions not specified by the source
Ivanti

Description’s affected range: before 22.7R2.9 or 22.8R2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

A remote authenticated attacker can hijack existing HTML5 connections. Source advisory’s CVSS 3.1 assessment (base score 8.9/10) rates confidentiality and integrity impact as high; availability impact as low.