CVE-2025-55146: Ivanti Connect Secure DOS Vulnerability

CVE-2025-55146 Overview

CVE-2025-55146 is a denial-of-service vulnerability affecting multiple Ivanti secure access products. The flaw stems from an unchecked return value [CWE-252] in the affected software. A remote authenticated attacker with administrative privileges can trigger the condition and disrupt service availability.

The issue impacts Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723, and Ivanti Neurons for Secure Access before 22.8R1.4. Ivanti deployed the fix for Neurons for Secure Access on 02-Aug-2025.

Critical Impact
An authenticated administrator can crash or otherwise disrupt the availability of Ivanti Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access appliances that mediate remote access to corporate resources.

Affected Products

Ivanti Connect Secure prior to 22.7R2.9 and 22.8R2
Ivanti Policy Secure prior to 22.7R1.6
Ivanti ZTA Gateway prior to 2.8R2.3-723 and Ivanti Neurons for Secure Access prior to 22.8R1.4

Discovery Timeline

2025-08-02 - Fix deployed for Ivanti Neurons for Secure Access
2025-09-09 - CVE-2025-55146 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55146

Vulnerability Analysis

CVE-2025-55146 is classified under CWE-252: Unchecked Return Value. The affected Ivanti products fail to verify the return status of an internal function call. When the underlying operation fails, execution continues with an invalid or unexpected state, driving the appliance into a fault path that terminates availability.

The result is a denial-of-service condition against the affected gateway. Because Ivanti Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access broker remote access to internal applications, loss of availability directly interrupts user connectivity and administrative operations. Confidentiality and integrity are not affected.

Root Cause

The root cause is a missing check on a return value in the shared code base used across the affected Ivanti products. Without validating the result, subsequent logic operates on an unhandled error condition. This defect is reachable from an authenticated administrative context.

Attack Vector

Exploitation requires network reachability to the administrative interface and valid administrator credentials. A remote authenticated attacker with admin privileges issues a request that triggers the unchecked failure path, causing the appliance to enter a denial-of-service state. No user interaction is required, and no code execution or data exposure results from the flaw.

Because the attack requires administrator privileges, the practical risk profile centers on compromised or misused administrative accounts, insider actions, or attackers who chain this issue with a separate credential compromise or authentication bypass.

Detection Methods for CVE-2025-55146

Indicators of Compromise

Unexpected restarts, crashes, or unresponsiveness of Ivanti Connect Secure, Policy Secure, ZTA Gateway, or Neurons for Secure Access appliances
Administrative API or web console requests immediately preceding service disruption
Gaps in VPN session logs coinciding with administrative activity from an unusual source IP

Detection Strategies

Monitor administrative authentication events for anomalous source IPs, session times, or use of dormant admin accounts
Alert on repeated service restarts or watchdog-initiated recoveries on Ivanti gateways
Correlate administrator API requests with subsequent gateway availability failures to identify trigger patterns

Monitoring Recommendations

Forward Ivanti appliance system, audit, and admin logs to a centralized SIEM for retention and correlation
Track appliance uptime and health metrics with alerting on unplanned reboots
Review administrator account inventory and enforce logging of every privileged session

How to Mitigate CVE-2025-55146

Immediate Actions Required

Upgrade Ivanti Connect Secure to 22.7R2.9 or 22.8R2 or later
Upgrade Ivanti Policy Secure to 22.7R1.6 or later
Upgrade Ivanti ZTA Gateway to 2.8R2.3-723 or later; Ivanti Neurons for Secure Access received the fix on 02-Aug-2025
Restrict access to administrative interfaces to trusted management networks and enforce multi-factor authentication for all admin accounts

Patch Information

Refer to the Ivanti September Security Advisory for the authoritative version matrix, download links, and upgrade guidance across Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access.

Workarounds

Limit administrative access to the appliance to a hardened jump host or management VLAN
Reduce the number of accounts with administrator privileges and rotate credentials for existing admin users
Enable strict session logging and alerting on any administrative configuration action until patches are applied