CVE-2025-55143

score

<0.1

cvss

6.1

epss

0.7%

published

2025-09-09

kev added

—

first seen

2026-10-21

Ivanti Connect Secure < 22.7R2.9 or 22.8R2, Ivanti Policy Secure < 22.7R1.6, Ivanti ZTA Gateway < 2.8R2.3-723, and Ivanti Neurons for Secure Access < 22.8R1.4 contain a reflected XSS caused by improper input sanitization in HTTP responses, letting remote unauthenticated attackers inject arbitrary text, exploit requires user interaction.