CVE-2025-8712

MEDIUM5.4Auth bypass

Description

Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure restricted settings.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected products

Ivanti / Connect Secure22.7 – 22.7
Ivanti / Connect Secure22.7 – 22.7
Ivanti / Connect Secure22.7 – 22.7
Ivanti / Connect Secure22.7 – 22.7
Ivanti / Connect Secure22.7 – 22.7
Ivanti / Connect Secure22.7 – 22.7
Ivanti / Connect Secure22.7 – 22.7
Ivanti / Connect Secure22.7 – 22.7
Ivanti / Connect Secure22.7 – 22.7
Ivanti / Connect Secure22.7 – 22.7
Ivanti / Connect Secure22.7
Ivanti / Connect Secure22.7 – 22.7
Ivanti / Connect Secure22.7 – 22.7
Ivanti / Connect Secure22.7 – 22.7
Ivanti / Connect Secure22.7 – 22.7
Ivanti / Connect Secure22.7 – 22.7
Ivanti / Connect Secure22.7 – 22.7
Ivanti / Connect Secure before22.7R2.9 – 22.7R2.9
Ivanti / Connect Secure before22.8R2 – 22.8R2
Ivanti / Neurons for Secure Access22.8 – 22.8
Ivanti / Neurons for Secure Access22.8 – 22.8
Ivanti / Neurons for Secure Access22.8 – 22.8
Ivanti / Neurons for Secure Access22.8 – 22.8
Ivanti / Neurons for Secure Access22.8
Ivanti / Neurons for Secure Access22.8R1.4 (Fix deployed on 02-Aug-2025) – 22.8R1.4 (Fix deployed on 02-Aug-2025)
Ivanti / Policy Secure22.7
Ivanti / Policy Secure22.7R1.6 – 22.7R1.6
Ivanti / Policy Secure22.7 – 22.7
Ivanti / Policy Secure22.7 – 22.7
Ivanti / Policy Secure22.7 – 22.7
Ivanti / Policy Secure22.7 – 22.7
Ivanti / Policy Secure22.7 – 22.7
Ivanti / Policy Secure22.7 – 22.7
Ivanti / Policy Secure22.7 – 22.7
Ivanti / zero_trust_access_gateway22.8 – 22.8
Ivanti / ZTA Gateway22.8R2.3-723 – 22.8R2.3-723

References

MISChttps://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs

Updated 16m ago · 8 sources