CVE-2025-22462

critical

Description

An authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Security Patch allows a remote unauthenticated attacker to gain administrative access to the system.

References

References
More

https://www.theregister.com/2025/05/14/ivanti_patches_two_zerodays_and/

https://www.securityweek.com/ivanti-patches-two-epmm-zero-days-exploited-to-hack-customers/

https://thehackernews.com/2025/05/ivanti-patches-epmm-vulnerabilities.html

https://www.helpnetsecurity.com/2025/05/13/ivanti-epmm-vulnerabilities-exploited-in-the-wild-cve-2025-4427-cve-2025-4428/

https://www.bleepingcomputer.com/news/security/ivanti-warns-of-critical-neurons-for-itsm-auth-bypass-flaw/

https://www.bleepingcomputer.com/news/security/ivanti-fixes-epmm-zero-days-chained-in-code-execution-attacks/

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-on-premises-only-CVE-2025-22462

Details

Source: Mitre, NVD

Published: 2025-05-13

Updated: 2025-05-13

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H