CVE-2025-5466 Overview
CVE-2025-5466 is an XML External Entity Expansion (XEE) vulnerability affecting multiple Ivanti secure access products. The flaw enables a remote authenticated attacker with administrative privileges to trigger a denial-of-service condition on affected appliances. The vulnerability is classified under [CWE-776] (Improper Restriction of Recursive Entity References in DTDs, also known as XML Entity Expansion).
The issue impacts Ivanti Connect Secure, Ivanti Policy Secure, Ivanti ZTA Gateway, and Ivanti Neurons for Secure Access. Ivanti disclosed the flaw as part of its August 2025 security advisory. The cloud-hosted Neurons for Secure Access fix was deployed on 02-Aug-2025.
Critical Impact
An authenticated administrator can crash or degrade availability of Ivanti gateway services, disrupting remote access for downstream users.
Affected Products
- Ivanti Connect Secure before 22.7R2.8 or 22.8R2
- Ivanti Policy Secure before 22.7R1.5
- Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4
Discovery Timeline
- 02-Aug-2025 - Fix deployed to Ivanti Neurons for Secure Access
- 2025-08-12 - CVE-2025-5466 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-5466
Vulnerability Analysis
The vulnerability is an XML Entity Expansion issue in Ivanti's XML parsing routines. The parser processes XML input without adequately restricting recursive or nested entity references. An attacker submits crafted XML containing deeply nested or self-referencing entity declarations. The parser expands these entities recursively, consuming excessive CPU or memory.
Exploitation requires administrator-level authentication, which limits the attack surface to accounts already trusted with high privileges. Successful exploitation produces a denial-of-service outcome. Confidentiality and integrity of data on the appliance are not directly affected.
Root Cause
The root cause is improper restriction of recursive entity references in Document Type Definitions (DTDs) processed by the affected Ivanti components. When the XML parser accepts a document that defines entities referring to other entities, it fails to enforce sufficient expansion or depth limits. This produces classic entity expansion behavior, sometimes called a "billion laughs" pattern, which multiplies memory and CPU consumption exponentially.
Attack Vector
The attack vector is network-based against management or administrative XML-processing endpoints exposed by Connect Secure, Policy Secure, ZTA Gateway, or Neurons for Secure Access. An authenticated administrator submits a crafted XML payload containing chained entity declarations. The parser attempts to resolve the entities, exhausts appliance resources, and the affected service becomes unresponsive or crashes. No user interaction is required beyond the attacker's own authenticated session.
No public proof-of-concept exploit or exploitation activity has been reported for CVE-2025-5466 at time of writing, and the issue is not listed on the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-5466
Indicators of Compromise
- Unexpected crashes, restarts, or unresponsiveness of Ivanti Connect Secure, Policy Secure, ZTA Gateway, or Neurons for Secure Access services
- Sudden spikes in CPU or memory usage on affected appliances correlated with administrator API or web-console activity
- Administrator-authenticated HTTP requests containing XML bodies with nested <!ENTITY> declarations or DOCTYPE definitions
Detection Strategies
- Inspect appliance access and audit logs for administrator sessions submitting XML payloads immediately preceding service degradation
- Correlate resource-exhaustion events on Ivanti gateways with prior administrative logins from unusual source IPs or off-hours sessions
- Alert on repeated admin API calls returning 5xx errors or timeouts after XML submissions
Monitoring Recommendations
- Forward Ivanti appliance syslog and admin audit events to a centralized SIEM for correlation with authentication telemetry
- Baseline normal administrator activity volumes and alert on deviations, particularly XML-parsing operations
- Monitor appliance health metrics (CPU, memory, process restarts) with thresholds tuned to detect denial-of-service patterns
How to Mitigate CVE-2025-5466
Immediate Actions Required
- Upgrade Ivanti Connect Secure to 22.7R2.8 or 22.8R2 or later
- Upgrade Ivanti Policy Secure to 22.7R1.5 or later
- Upgrade Ivanti ZTA Gateway to 22.8R2.3-723 or later; confirm the Neurons for Secure Access fix deployed on 02-Aug-2025 is in effect for 22.8R1.4 tenants
- Audit and reduce the number of accounts holding administrative privileges on affected appliances
Patch Information
Ivanti published fixed versions in its August 2025 security advisory. Refer to the Ivanti August Security Advisory for Connect Secure, Policy Secure, and ZTA Gateways for release notes and download instructions. Neurons for Secure Access, as a cloud service, was patched by Ivanti on 02-Aug-2025.
Workarounds
- Restrict administrative access to the appliance management interface via network ACLs, jump hosts, or VPN-only reachability
- Enforce multi-factor authentication on all administrative accounts to reduce the likelihood of credential-based access to the vulnerable admin endpoints
- Review administrator account inventory and disable unused or dormant admin accounts until patching is complete
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
