CVE-2025-55139

Published: Sep 9, 2025

Modified: Sep 9, 2025

PUBLISHED

CVSS v3.1

6.8

MEDIUM

Description

SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to enumerate internal services.

Vendor	Product	Versions
Ivanti	Connect Secure	unaffected `22.7R2.9` unaffected `22.8R2`
Ivanti	Policy Secure	unaffected `22.7R1.6`
Ivanti	ZTA Gateway	unaffected `2.8R2.3-723`
Ivanti	Neurons for Secure Access	unaffected `22.8R1.4 (Fix deployed on 02-Aug-2025)`

Weaknesses (CWE)

CWE-918

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

References

https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2025-55139

Description

Affected Products

Weaknesses (CWE)

CVSS v3.1 Details

References