Introduction
One click from an authenticated administrator is enough for an attacker to silently reconfigure a VPN gateway or change network access policies. Ivanti's edge security appliances have been a high-value target for advanced threat actors throughout 2025, and CVE-2025-55147 adds another serious flaw to the list of vulnerabilities in these products.
Ivanti is a major global vendor of enterprise remote access, VPN, and zero trust products, with customers in critical infrastructure, finance, healthcare, and government. Many organizations deploy Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access as core parts of their network security, so a vulnerability in these systems can affect thousands of organizations worldwide.
Technical Information
CVE-2025-55147 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352. It affects the web-based administrative interfaces of Ivanti Connect Secure (prior to 22.7R2.9 or 22.8R2), Policy Secure (prior to 22.7R1.6), ZTA Gateway (prior to 2.8R2.3-723), and Neurons for Secure Access (prior to 22.8R1.4).
The affected products do not properly validate where requests come from, and they do not require anti-CSRF tokens for sensitive actions. If an authenticated user, such as an administrator, is tricked into visiting a malicious website or clicking a crafted link, the attacker can make that user's browser send forged requests to the Ivanti management interface. The interface executes those requests with the user's privileges. An attacker can use this to change configurations, modify access policies, or potentially disable security controls.
Exploitation requires user interaction, usually through social engineering. The attacker has to get a logged-in user to interact with malicious content, for example a phishing email or a malicious web page. The attack relies on the browser automatically attaching authentication cookies or session tokens to cross-origin requests, which gets the forged request past authentication checks when CSRF protections are absent or insufficient.
No public code snippets, exploit scripts, or detailed PoC are available for this vulnerability. The root cause is that the affected Ivanti product versions either lack anti-CSRF mechanisms or implement them improperly.
Affected Systems and Versions
- Ivanti Connect Secure: versions before 22.7R2.9 or 22.8R2
- Ivanti Policy Secure: versions before 22.7R1.6
- Ivanti ZTA Gateway: versions before 2.8R2.3-723
- Ivanti Neurons for Secure Access: versions before 22.8R1.4
Any configuration that exposes the web-based management interface and runs an affected version is potentially vulnerable.
Vendor Security History
Ivanti has had a series of high-severity vulnerabilities in 2025, including CVE-2025-22457 (a stack-based buffer overflow in Connect Secure, Policy Secure, and ZTA Gateway) and multiple issues in its Endpoint Manager Mobile products. Advanced threat actors, including China-nexus espionage groups, have actively exploited these vulnerabilities. Ivanti has generally issued patches and advisories promptly, but critical flaws keep recurring in its edge and access products, which points to ongoing problems in its secure development and testing practices.
