Ivanti patches multiple Connect Secure and ZTA flaws enabling DoS and file read

Ivanti released security updates for Ivanti Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access to fix four vulnerabilities, including two high-severity remote unauthenticated denial-of-service flaws tracked as CVE-2025-5456 and CVE-2025-5462. The bugs stem from memory-safety weaknesses including a buffer over-read and a heap-based buffer overflow that can be triggered through crafted network input, potentially crashing appliances that provide VPN, zero-trust, and access-control services. Ivanti said cloud instances of Neurons for Secure Access were remediated by August 2, 2025, while on-premises customers must apply the fixed releases.

The same advisory also addressed CVE-2025-5466, an authenticated administrator XXE issue that can cause denial of service, and CVE-2025-5468, a symbolic link handling flaw that could let a local authenticated attacker read arbitrary files. Ivanti said it had no evidence of customer exploitation before disclosure and that the issues were found through internal assessments and responsible disclosure, but the breadth of affected products increases operational risk for enterprises relying on Ivanti remote access infrastructure. The company also noted that Pulse Connect Secure 9.x no longer receives backported fixes because it has reached end of support.