CVE-2025-5468 Details
Description
Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a local authenticated attacker to read arbitrary files on disk.
A vulnerability exists in Ivanti Connect Secure (ICS) versions prior to 22.7R2.8 or 22.8R2, Ivanti Policy Secure (IPS) versions prior to 22.7R1.5, Ivanti ZTA Gateway versions prior to 22.8R2.3-723, and Ivanti Neurons for Secure Access versions prior to 22.8R1.4. This vulnerability arises from improper handling of symbolic links, which allows a local authenticated attacker to read arbitrary files from the disk.
Users of Ivanti Connect Secure should update to version 22.7R2.8 or 22.8R2. Users of Ivanti Policy Secure should update to version 22.7R1.5. Ivanti ZTA Gateway users should update to version 22.8R2.3-723, available in the controller for download. For Ivanti Neurons for Secure Access, the fix has been applied to cloud environments as of August 2, 2025.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 12, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://forums.ivanti.com/s/article/August-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-Multiple-CVEs?language=en_US | ivanti | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-61 | UNIX Symbolic Link (Symlink) Following | ivanti |
Affected Products
| Product | Versions |
|---|---|
| ivanti connect secure | < 22.7 22.7 - 22.7 r1 22.7 r1.1 22.7 r1.2 22.7 r1.3 22.7 r1.4 22.7 r1.5 22.7 r2 22.7 r2.1 22.7 r2.2 22.7 r2.3 22.7 r2.4 22.7 r2.5 22.7 r2.6 22.7 r2.7 |
CPE
Remediation
| |
| ivanti policy secure | < 22.7 22.7 - 22.7 r1 22.7 r1.1 22.7 r1.2 22.7 r1.3 22.7 r1.4 |
CPE
Remediation
| |
| ivanti zero trust access gateway | 22.8 r2.2 |
CPE
Remediation
| |
| ivanti neurons for secure access | < 22.8 22.8 r1 22.8 r1.1 22.8 r1.2 22.8 r1.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | ivanti |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2025 | Initial Analysis | [email protected] |
| Aug 12, 2025 | New CVE Received | ivanti |