CVE-2025-8711: connect secure 22.7; +7 more affected products

Affected technology

connect secure · before 22.7 (exclusive)
ivanti

connect secure · 22.7
ivanti

connect secure · 22.7 · update r1
ivanti

connect secure · 22.7 · update r1.1
ivanti

connect secure · 22.7 · update r1.2
ivanti

connect secure · 22.7 · update r1.3
ivanti

connect secure · 22.7 · update r1.4
ivanti

connect secure · 22.7 · update r1.5
ivanti

connect secure · 22.7 · update r2
ivanti

connect secure · 22.7 · update r2.1
ivanti

connect secure · 22.7 · update r2.2
ivanti

connect secure · 22.7 · update r2.3
ivanti

connect secure · 22.7 · update r2.4
ivanti

connect secure · 22.7 · update r2.5
ivanti

connect secure · 22.7 · update r2.6
ivanti

connect secure · 22.7 · update r2.7
ivanti

connect secure · 22.7 · update r2.8
ivanti

policy secure · before 22.7 (exclusive)
ivanti

policy secure · 22.7
ivanti

policy secure · 22.7 · update r1
ivanti

policy secure · 22.7 · update r1.1
ivanti

policy secure · 22.7 · update r1.2
ivanti

policy secure · 22.7 · update r1.3
ivanti

policy secure · 22.7 · update r1.4
ivanti

policy secure · 22.7 · update r1.5
ivanti

zero trust access gateway · 22.8 · update r2.2
ivanti

neurons for secure access · before 22.8 (exclusive)
ivanti

neurons for secure access · 22.8 · update r1
ivanti

neurons for secure access · 22.8 · update r1.1
ivanti

neurons for secure access · 22.8 · update r1.2
ivanti

neurons for secure access · 22.8 · update r1.3
ivanti

Connect Secure · Exact affected versions not specified by the source
Ivanti

Policy Secure · Exact affected versions not specified by the source
Ivanti

ZTA Gateway · Exact affected versions not specified by the source
Ivanti

Neurons for Secure · Exact affected versions not specified by the source
Ivanti

Description’s affected range: before 22.7R2.9 or 22.8R2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

A remote unauthenticated attacker can execute limited actions on behalf of the victim user. Source advisory’s CVSS 3.1 assessment (base score 5.4/10) rates confidentiality and integrity impact as low; availability impact as none.