Inclusion of Sensitive Information in Log Files in Ivanti Policy Secure (formerly Pulse Policy Secure) and Ivanti Connect Secure (formerly Pulse Connect Secure) - CVE-2025-5463
Published: July 8, 2025
Vulnerability identifier: #VU112537
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-5463
CWE-ID: CWE-532
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to software stores sensitive information into log files. A local user can read the log files and gain access to sensitive data.
Affected software
Ivanti Policy Secure (formerly Pulse Policy Secure)
Ivanti Connect Secure (formerly Pulse Connect Secure)
Ivanti Connect Secure (formerly Pulse Connect Secure)
How to mitigate CVE-2025-5463
Install updates from vendor's website.
Ivanti Policy Secure (formerly Pulse Policy Secure) - update to 22.7R1.5
Ivanti Connect Secure (formerly Pulse Connect Secure) - update to 22.7R2.8
Ivanti Connect Secure (formerly Pulse Connect Secure) - update to 22.7R2.8