Vulnerability Description
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker to hijack existing HTML5 connections.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ivanti | Neurons For Secure Access | < 22.8 |
| Ivanti | Connect Secure | < 22.7 |
| Ivanti | Policy Secure | < 22.7 |
| Ivanti | Zero Trust Access Gateway | 22.8 |
Related Weaknesses (CWE)
References
FAQ
What is CVE-2025-55145?
CVE-2025-55145 is a vulnerability with a CVSS score of 8.9 (HIGH). Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R...
How severe is CVE-2025-55145?
CVE-2025-55145 has been rated HIGH with a CVSS base score of 8.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-55145?
Check the references section above for vendor advisories and patch information. Affected products include: Ivanti Neurons For Secure Access, Ivanti Connect Secure, Ivanti Policy Secure, Ivanti Zero Trust Access Gateway.