Introduction
Session hijacking in enterprise remote access infrastructure can give an attacker unauthorized access to sensitive data and a path for lateral movement inside a corporate network. CVE-2025-55145 is a high-severity missing authorization vulnerability in Ivanti's Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access products. On unpatched systems, a remote authenticated attacker can use it to hijack existing HTML5 sessions.
Ivanti is a large enterprise IT and security vendor, best known for Connect Secure (formerly Pulse Secure), its VPN and remote access product. Its customers number in the thousands worldwide and include critical infrastructure operators, government agencies, and Fortune 500 companies. Its remote access and endpoint management products are widely deployed, so a vulnerability in them affects a large part of the industry.
Technical Information
CVE-2025-55145 is classified under CWE-862 (Missing Authorization). The vulnerability is in the HTML5 connection handling logic of Ivanti's remote access products. After a user authenticates, the server does not properly check whether that user is authorized to perform operations on existing HTML5 sessions. A remote authenticated attacker can therefore hijack HTML5 connections that other users established. Depending on the attacker's privileges and network position, this can let them intercept or manipulate session data.
The flaw is in components shared by Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access. An attacker with valid credentials triggers it by interacting with the HTML5 session management endpoints, which do not sufficiently validate whether the user is authorized to access or control the targeted session. No public exploit code or vulnerable code snippets are available. Initial authentication is unaffected. The bug is in the authorization logic that governs sessions after login.
Affected Systems and Versions
- Ivanti Connect Secure: All versions before 22.7R2.9 or 22.8R2
- Ivanti Policy Secure: All versions before 22.7R1.6
- Ivanti ZTA Gateway: All versions before 2.8R2.3-723
- Ivanti Neurons for Secure Access: All versions before 22.8R1.4
Cloud-based Neurons for Secure Access deployments received fixes automatically on August 2, 2025. On-premises deployments must be updated manually to the versions listed above or later.
Vendor Security History
Ivanti's remote access products have had several critical vulnerabilities in 2025. CVE-2025-22457, a buffer overflow in Connect Secure, was patched silently before anyone recognized it as a security issue, and that led to active exploitation by advanced threat actors. Other 2025 vulnerabilities include CVE-2025-4427 and CVE-2025-4428 in Endpoint Manager Mobile, which were also exploited in the wild. Ivanti has since made its security advisories more transparent and improved its patch response, but recurring issues in shared components are still a concern.
