Introduction
Remote attackers can crash critical Ivanti security appliances without authentication, disrupting VPN and access control for thousands of users. CVE-2025-5456 affects a wide range of Ivanti's core products. Ivanti fixed cloud deployments proactively and released a patch only after that.
Ivanti is a major enterprise security vendor that operates globally. Its products include Connect Secure (formerly Pulse Secure), Policy Secure, ZTA Gateway, and Neurons for Secure Access, and large organizations use them widely for secure remote access and network policy enforcement.
Technical information
CVE-2025-5456 is a buffer over-read vulnerability (CWE-125) in multiple Ivanti security products. The software reads past the end of an allocated buffer, typically because bounds checks are missing or incorrect when it processes network data. An unauthenticated remote attacker can exploit this to cause a denial of service (a system crash or instability).
The vulnerable code sits in components shared by Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access. The root cause is that the network packet or protocol parsing routines do not properly validate buffer boundaries. The affected code is likely written in C or C++, languages prone to this kind of memory safety issue when strict bounds checking is not enforced. No public code snippets or proof of concept have been released.
Affected systems and versions
- Ivanti Connect Secure: all versions before 22.7R2.8 or 22.8R2
- Ivanti Policy Secure: all versions before 22.7R1.5
- Ivanti ZTA Gateway: all versions before 2.8R2.3-723
- Ivanti Neurons for Secure Access: all versions before 22.8R1.4
Cloud deployments of Neurons for Secure Access were patched as of August 2, 2025. On-premises deployments must be upgraded manually to the fixed versions listed above.
Vendor security history
Ivanti has dealt with a series of critical vulnerabilities in 2025. China-nexus threat actors actively exploited CVE-2025-22457, a buffer overflow in Connect Secure. CVE-2025-4427 and CVE-2025-4428 (authentication bypass and RCE in Endpoint Manager Mobile) were also exploited in the wild, and the attacks affected critical sectors such as healthcare and finance. Ivanti has improved its patch response times and transparency, but memory safety and access control flaws keep recurring across its product lines.
