Ivanti Connect Secure, Policy Secure, ZTA Gateway and Neurons for Secure Access Buffer Over-Read Vulnerability Allowing Denial-of-Service

A buffer over-read vulnerability has been identified in multiple Ivanti products, including Ivanti Connect Secure versions prior to 22.7R2.8 or 22.8R2, Ivanti Policy Secure versions prior to 22.7R1.5, Ivanti ZTA Gateway versions prior to 22.8R2.3-723, and Ivanti Neurons for Secure Access versions prior to 22.8R1.4. This vulnerability allows remote, unauthenticated attackers to trigger a denial-of-service condition.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing affected services to become unavailable or unresponsive.

Remediation

Users of Ivanti Connect Secure should update to version 22.7R2.8 or 22.8R2. Those using Ivanti Policy Secure should update to version 22.7R1.5. Ivanti ZTA Gateway users can download version 22.8R2.3-723 from the controller. For Ivanti Neurons for Secure Access, the fix has been applied to cloud environments as of August 2, 2025.