Main Vulnerability Database Vulnerabilities #VU115033

Improper authorization in Ivanti Policy Secure (formerly Pulse Policy Secure) and Ivanti Connect Secure (formerly Pulse Connect Secure) - CVE-2025-55141

Published: September 9, 2025

Vulnerability identifier: #VU115033

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-55141

CWE-ID: CWE-285

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to bypass authorization checks.

The vulnerability exists due to improper authorization check. A remote user with read-only admin privileges can configure authentication related settings and escalate privileges on the system.

Affected software

Ivanti Policy Secure (formerly Pulse Policy Secure)
Ivanti Connect Secure (formerly Pulse Connect Secure)

How to mitigate CVE-2025-55141

Install updates from vendor's website.

Ivanti Policy Secure (formerly Pulse Policy Secure) - update to 22.7R1.5
Ivanti Connect Secure (formerly Pulse Connect Secure) - addressed in versions 22.7R2.9, 22.8R2

External References

https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US&_gl=1*1czhpgc*_gcl_au*NzkxMzg0ODIwLjE3NTc0MzQyMDE.

Related Security Bulletins