SecuriTricks - CVE-2025-5466

Description

XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to trigger a denial of service

Product(s) Impacted

Vendor	Product	Versions
Ivanti	Connect Secure Policy Secure Zta Gateway Neurons For Secure Access	<22.7R2.8 <22.7R1.5 <22.8R2.3-723 <22.8R1.4

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-776

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	ivanti	connect_secure	<22.7R2.8	/	/	/	/	/	/	/
a	ivanti	policy_secure	<22.7R1.5	/	/	/	/	/	/	/
a	ivanti	zta_gateway	<22.8R2.3-723	/	/	/	/	/	/	/
a	ivanti	neurons_for_secure_access	<22.8R1.4	/	/	/	/	/	/	/

References

https://forums.ivanti.com/s/article/August-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-Multiple-CVEs?language=en_US

CVSS Score

4.9 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: HIGH
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

View Vector String

Timeline

Published: Aug. 12, 2025, 3:15 p.m.
Last Modified: Aug. 13, 2025, 5:34 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

3c1d8aa1-5a33-4ea4-8992-aadd6440af75

CVE-2025-5466