Privilege Escalation in Ivanti Connect Secure, Policy Secure, and Neurons for ZTA Gateways

Successful exploitation allows an authenticated attacker with local access to elevate privileges on the affected Ivanti appliance. This can undermine the confidentiality, integrity, and availability of the system by enabling the attacker to gain higher-level control than intended, potentially facilitating follow-on actions such as tampering with configuration, accessing restricted data, or establishing deeper persistence.

The primary mitigation is prompt patching to the fixed versions. In addition, restrict local and authenticated access to affected appliances to only trusted administrators, minimize the number of accounts capable of interactive access, and increase monitoring for suspicious privilege-escalation activity on Ivanti devices. Where compromise is suspected, perform forensic review and follow Ivanti guidance; the Integrity Checker Tool is referenced in the advisory context for assessing related Ivanti exploitation activity, although the provided content specifically ties exploitation detection guidance more directly to CVE-2025-0282.

Upgrade to a fixed release provided by Ivanti: Ivanti Connect Secure 22.7R2.5 or later, Ivanti Policy Secure 22.7R1.2 or later, and Ivanti Neurons for ZTA gateways 22.7R2.3 or later. Apply vendor updates through the Ivanti download portal and review the associated Ivanti security advisory for any product-specific post-update guidance. Because patching does not by itself remediate prior compromise, organizations should also assess affected appliances for signs of unauthorized activity.