CVE-2025-5462

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to trigger a denial of service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-122

Affected software

VendorProductVersions
IvantiConnect Secure—
IvantiPolicy Secure—
IvantiZTA Gateway—
IvantiNeurons for Secure Access—

References

Timeline

Published
Aug 12, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-546205.5Deserialization vulnerability of untrusted data in the ability module. Impact: Successful exploitation of this vulnerability may affect avaiCVE-2025-546213.3Iterator failure issue in the WantAgent module. Impact: Successful exploitation of this vulnerability may cause memory release failures.CVE-2025-546227.4Binding authentication bypass vulnerability in the devicemanager module. Impact: Successful exploitation of this vulnerability may affect seCVE-2025-546236.5Out-of-bounds read vulnerability in the devicemanager module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2025-546245.7Unexpected injection event vulnerability in the multimodalinput module. Impact: Successful exploitation of this vulnerability may affect avaCVE-2025-546254.7Race condition vulnerability in the kernel file system module. Impact: Successful exploitation of this vulnerability may affect availabilityCVE-2025-546264.4Pointer dangling vulnerability in the cjwindow module. Impact: Successful exploitation of this vulnerability may affect function stability.CVE-2025-546278.8Out-of-bounds write vulnerability in the skia module. Impact: Successful exploitation of this vulnerability may affect service confidentialiCVE-2025-546287.5Vulnerability of incomplete verification information in the communication module. Impact: Successful exploitation of this vulnerability may CVE-2025-546294.7Race condition issue occurring in the physical page import process of the memory management module. Impact: Successful exploitation of this CVE-2025-54635.5Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version CVE-2025-546307.5:Vulnerability of insufficient data length verification in the DFA module. Impact: Successful exploitation of this vulnerability may affect
CVE-2025-5462: High severity, CVSS 7.5 | Vulnix