Main Vulnerability Database Vulnerabilities #VU115034

Improper authorization in Ivanti Policy Secure (formerly Pulse Policy Secure) and Ivanti Connect Secure (formerly Pulse Connect Secure) - CVE-2025-55142

Published: September 9, 2025

Vulnerability identifier: #VU115034

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-55142

CWE-ID: CWE-285

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to bypass authorization checks.

The vulnerability exists due to improper authorization check. A remote user with read-only admin privileges can configure authentication related settings and escalate privileges on the system.

Affected software

Ivanti Policy Secure (formerly Pulse Policy Secure)
Ivanti Connect Secure (formerly Pulse Connect Secure)

How to mitigate CVE-2025-55142

Install updates from vendor's website.

Ivanti Policy Secure (formerly Pulse Policy Secure) - update to 22.7R1.5
Ivanti Connect Secure (formerly Pulse Connect Secure) - addressed in versions 22.7R2.9, 22.8R2

External References

https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US&_gl=1*1czhpgc*_gcl_au*NzkxMzg0ODIwLjE3NTc0MzQyMDE.

Related Security Bulletins