CVE-2025-5468

5.5 mediumEPSS 0.4%

Medium (5.5) in ivanti. EPSS 0.4% chance of exploitation in the next 30 days.

Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a local authenticated attacker to read arbitrary files on disk.

Severity

CVSS 3.1

5.5 medium

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-31)
CWE: CWE-61
Published: 2025-08-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ivanti:connect_secure
ivanti:neurons_for_secure_access
ivanti:policy_secure
ivanti:zero_trust_access_gateway

References

https://forums.ivanti.com/s/article/August-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-Multiple-CVEs?language=en_US

Check your stack JSON