Introduction
A remote attacker with only read-only administrative access can reconfigure authentication on your Ivanti Connect Secure or Policy Secure appliance. The flaw allows privilege escalation and direct tampering with authentication mechanisms that should be tightly controlled in any enterprise environment.
Ivanti is a major provider of secure remote access, network policy enforcement, and zero trust solutions. Its Connect Secure (formerly Pulse Secure), Policy Secure, ZTA Gateway, and Neurons for Secure Access platforms are widely deployed in government, healthcare, and critical infrastructure. Ivanti has a global customer base and a history of critical vulnerabilities, and its products are a frequent target for advanced threat actors.
Technical Information
CVE-2025-55142 is a missing authorization vulnerability (CWE-862) in the administrative interfaces of several Ivanti security products. A remote authenticated attacker with read-only administrative privileges can modify authentication-related settings, including configuration parameters for password policies, multi-factor authentication, and external identity provider integration.
The affected products do not properly enforce privilege checks in the code paths that handle authentication configuration. As a result, users with read-only admin roles can make sensitive changes that should be limited to fully privileged administrators. This violates the intended access control model and enables privilege escalation within the administrative interface.
Any authenticated user with read-only admin access can exploit the vulnerability remotely. No public exploit details or code snippets are available. The issue is present in the web-based administrative UI and likely also in the associated management APIs.
Affected Systems and Versions
- Ivanti Connect Secure: all versions before 22.7R2.9 or 22.8R2
- Ivanti Policy Secure: all versions before 22.7R1.6
- Ivanti ZTA Gateway: all versions before 2.8R2.3-723
- Ivanti Neurons for Secure Access: all versions before 22.8R1.4
Any configuration running an affected version is vulnerable if read-only admin accounts exist.
Vendor Security History
Ivanti has had multiple critical vulnerabilities in 2025, including:
- CVE-2025-22457: Stack-based buffer overflow in Connect Secure, exploited by UNC5221
- CVE-2025-0282 and CVE-2025-0283: Remote code execution and privilege escalation in Connect Secure, Policy Secure, and ZTA
- CVE-2025-4427 and CVE-2025-4428: Zero-days in Endpoint Manager Mobile, also exploited in the wild
Ivanti has accelerated its patch release cycle and improved advisory transparency. Still, authorization and memory safety flaws keep recurring, which indicates ongoing architectural and process problems.
