Ivanti
CVE-2025-22454
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Insufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.
AnalysisAI
Insufficiently restrictive permissions in Ivanti Secure Access Client versions up to 22.7 is affected by incorrect permission assignment for critical resource (CVSS 7.8).
Technical ContextAI
This vulnerability (CWE-732: Incorrect Permission Assignment for Critical Resource) affects Insufficiently restrictive permissions in Ivanti Secure Access Client. Insufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.
Affected ProductsAI
Product: Insufficiently restrictive permissions in Ivanti Secure Access Client. Versions: up to 22.7.
RemediationAI
Monitor vendor advisories for a patch.
Ivanti Connect Secure and Policy Secure contain an authenticated command injection in web components allowing administra
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execut
Ivanti Connect Secure and Policy Secure contain an authentication bypass in the web component allowing unauthenticated a
Ivanti Connect Secure and Policy Secure contain an SSRF vulnerability in the SAML component allowing unauthenticated acc
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or re
Authentication bypass in Ivanti Virtual Traffic Manager (vTM) admin panel allows remote unauthenticated attackers to gai
Ivanti Endpoint Manager contains an absolute path traversal vulnerability allowing unauthenticated remote attackers to l
Ivanti Endpoint Manager contains a second absolute path traversal vulnerability for unauthenticated information disclosu
Ivanti Endpoint Manager contains a third absolute path traversal vulnerability for unauthenticated information disclosur
Ivanti Connect Secure, Policy Secure, and Neurons for ZTA contain a stack-based buffer overflow allowing unauthenticated
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to a
Ivanti Endpoint Manager Mobile (EPMM) contains a critical code injection vulnerability (CVE-2026-1281, CVSS 9.8) that al
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today