XML Entity Expansion in Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure (formerly Pulse Policy Secure) - CVE-2025-5466
Published: August 12, 2025
Vulnerability identifier: #VU113827
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-5466
CWE-ID: CWE-776
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Ivanti
Affected software:
Ivanti Connect Secure (formerly Pulse Connect Secure)
Ivanti Policy Secure (formerly Pulse Policy Secure)
Ivanti Connect Secure (formerly Pulse Connect Secure)
Ivanti Policy Secure (formerly Pulse Policy Secure)
Detailed vulnerability description
The vulnerability allows a remote user to perform a denial of service attack.
The vulnerability exists due to insufficient input validation when handling XML data. A remote user with admin privileged can perform a denial of service (DoS) attack.
How to mitigate CVE-2025-5466
Install updates from vendor's website.