CVE-2025-55144 Overview
CVE-2025-55144 is a missing authorization vulnerability [CWE-862] affecting Ivanti Connect Secure, Ivanti Policy Secure, Ivanti ZTA Gateway, and Ivanti Neurons for Secure Access. The flaw allows a remote authenticated attacker holding read-only admin privileges to configure restricted settings that should be reserved for higher-privileged roles. Ivanti addressed the issue across multiple product lines, with the cloud-delivered Neurons for Secure Access fix deployed on 02-Aug-2025.
Critical Impact
A read-only administrator can modify restricted configuration settings, breaking the enforcement boundary between read-only and privileged administrative roles.
Affected Products
- Ivanti Connect Secure before 22.7R2.9 or 22.8R2
- Ivanti Policy Secure before 22.7R1.6
- Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4
Discovery Timeline
- 02-Aug-2025 - Fix deployed for Ivanti Neurons for Secure Access
- 2025-09-09 - CVE-2025-55144 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-55144
Vulnerability Analysis
The vulnerability stems from missing authorization checks within administrative configuration endpoints across Ivanti's secure access product line. The application authenticates the caller and confirms an administrative session, but it does not verify whether the specific administrative role has permission to modify restricted settings. As a result, an account provisioned as a read-only administrator can invoke configuration operations intended for full administrators.
The weakness is classified under CWE-862: Missing Authorization. The affected products serve as VPN gateways, network policy enforcement points, and zero-trust access brokers, so unauthorized configuration changes can weaken the security posture of the environment they protect.
Root Cause
The root cause is inconsistent enforcement of role-based access control on sensitive administrative endpoints. The affected components rely on session-level authentication to gate access, but fail to consult the caller's assigned administrative role before applying configuration changes. This decoupling of authentication from authorization is the defining pattern in CWE-862 findings.
Attack Vector
Exploitation requires a valid read-only administrator account and network access to the management interface. The attacker authenticates using existing credentials, then issues configuration requests that the server processes without verifying elevated privilege. Because the impact is limited to configuration modification available to authenticated administrative users, the attack does not enable unauthenticated remote code execution.
See the Ivanti Security Advisory for vendor-published technical detail. No public proof-of-concept exploit is currently listed for this CVE, and the EPSS probability remains low.
Detection Methods for CVE-2025-55144
Indicators of Compromise
- Configuration changes on Ivanti Connect Secure, Policy Secure, ZTA Gateway, or Neurons for Secure Access originating from accounts assigned a read-only administrator role.
- Unexpected modifications to authentication realms, sign-in policies, resource profiles, or role mappings on affected appliances.
- Administrative API calls to restricted configuration endpoints from sessions belonging to non-privileged admin users.
Detection Strategies
- Audit administrative event logs on affected Ivanti products and correlate the acting user's role with the sensitivity of the configuration action performed.
- Baseline the normal configuration change rate per administrator account and alert on deviations from that baseline.
- Forward Ivanti administrative logs into a centralized analytics platform to enable cross-appliance detection of role misuse.
Monitoring Recommendations
- Enable verbose audit logging for administrative and configuration subsystems on all Ivanti appliances in scope.
- Monitor authentication events for read-only admin accounts that suddenly perform write-class operations.
- Track version and patch levels of Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access to confirm the fixed builds are deployed.
How to Mitigate CVE-2025-55144
Immediate Actions Required
- Upgrade Ivanti Connect Secure to 22.7R2.9 or 22.8R2, Ivanti Policy Secure to 22.7R1.6, and Ivanti ZTA Gateway to 2.8R2.3-723 or later.
- Verify that Ivanti Neurons for Secure Access is running 22.8R1.4 or later; Ivanti deployed the cloud-side fix on 02-Aug-2025.
- Review all administrative accounts and remove or restrict any read-only admin accounts that are no longer required.
- Rotate credentials for any administrative accounts whose activity cannot be attested to during the exposure window.
Patch Information
Ivanti published fixes in the September Security Advisory covering Ivanti Connect Secure, Policy Secure, ZTA Gateways, and Neurons for Secure Access. Customers should consult the Ivanti Security Advisory for exact upgrade guidance, cumulative fix notes, and any dependencies between components in mixed deployments.
Workarounds
- Restrict management interface access to a dedicated administrative network segment or bastion host.
- Enforce multi-factor authentication on every administrative account, including read-only roles, to raise the bar for credential abuse.
- Apply the principle of least privilege by auditing each admin role assignment and removing read-only accounts that no longer have a business justification until patches are applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
