Introduction
A remote attacker with only limited admin privileges should not be able to reconfigure authentication settings on your VPN or Zero Trust gateway. CVE-2025-55141 is a critical authorization flaw in Ivanti's core secure access products, and it has real potential for privilege escalation and security policy bypass in production environments.
Ivanti is a major vendor in enterprise IT and network security, and products like Connect Secure and Policy Secure are widely used for VPN and network access control. Thousands of organizations worldwide deploy them, so any systemic flaw in their access control mechanisms has a large impact.
Technical Information
CVE-2025-55141 is a missing authorization vulnerability (CWE-862) in several Ivanti secure access products. The flaw is in the web-based administrative interface, where a remote authenticated user with read-only admin privileges can access and modify authentication-related settings.
This is privilege escalation. The system does not enforce proper authorization checks on sensitive configuration endpoints, so users who should only be able to view settings can alter authentication mechanisms. That could weaken security or give an attacker backdoor access. The root cause is insufficient validation of user permissions when the interface processes configuration changes. No public code snippets are available for this issue.
Affected Systems and Versions
- Ivanti Connect Secure: all versions before 22.7R2.9 or 22.8R2
- Ivanti Policy Secure: all versions before 22.7R1.6
- Ivanti ZTA Gateway: all versions before 2.8R2.3-723
- Ivanti Neurons for Secure Access: all versions before 22.8R1.4
A product running one of these versions is vulnerable in its default configuration.
Vendor Security History
Ivanti's secure access products have a documented history of critical vulnerabilities. Recent examples include CVE-2025-22457, which was initially mischaracterized as low risk and later found to be critical, along with authentication bypasses and privilege escalation flaws. Advanced threat actors have frequently targeted Ivanti products, including China-nexus groups such as UNC5221. Patch response times have improved, but high-impact vulnerabilities keep recurring, and that pattern raises concerns about the maturity of Ivanti's secure development lifecycle and the consistency of its codebase across product lines.
