Neurons For Zero-trust Access vulnerabilities

5 known vulnerabilities in Neurons For Zero-trust Access from Ivanti. 5 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.0 High severity

  Connect Secure: Out-of-bounds Write

  CVE-2025-0283Jan 8, 2025IvantiEPSS 17.5%

  A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a local authenticated attacker to escalate their privileges.

• 9.0 Critical severity

  Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Exploited

  CVE-2025-0282Jan 8, 2025IvantiEPSS 100%

  A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.

• 8.2 High severity

  Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Exploited

  CVE-2024-21893Jan 31, 2024IvantiEPSS 100%

  A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.

• 7.5 High severity

  Ivanti Connect Secure (ICS), Ivanti Policy…: Incorrect Calculation

  CVE-2022-35258Dec 5, 2022Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Neurons for Zero Trust Access GatewayEPSS 2.73%

  An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure (IPS) in versions prior to 9.1R17 and 22.3R1, and Ivanti Neuron

• 7.5 High severity

  Ivanti Connect Secure (ICS), Ivanti Policy…: Uncontrolled Resource Consumption

  CVE-2022-35254Dec 5, 2022Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Neurons for Zero Trust Access GatewayEPSS 2.73%

  An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure (IPS) in versions prior to 9.1R17 and 22.3R1, and Ivanti Neuron