CVE-2025-8711: Ivanti Connect Secure · Cross-Site Request Forgery (CSRF)
Affects Ivanti Connect SecureSource CVE Database V5
Not known to be exploited · CVSS 5.4 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 25% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 9 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Ivanti Connect Secure | Affected
| Fixed in– |
AI-suggested
To mitigate CVE-2025-8711, European organizations should: 1) Immediately apply the patches released on August 2, 2025, for all affected Ivanti products to ensure the vulnerability is remediated. 2) Implement strict Content Security Policy (CSP) headers and SameSite cookie attributes to reduce the risk of CSRF attacks by limiting cross-origin requests. 3) Educate users about the risks of clicking on unsolicited links or visiting untrusted websites, as user interaction is required for exploitation. 4) Employ multi-factor authentication (MFA) to reduce the impact of unauthorized actions if credentials are compromised. 5) Monitor logs and network traffic for unusual activity indicative of CSRF exploitation attempts, such as unexpected configuration changes or access patterns. 6) Where possible, restrict access to Ivanti management interfaces to trusted networks or VPNs to reduce exposure to remote attackers. 7) Regularly review and update security policies and incident response plans to include CSRF attack scenarios.
Description
CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to execute limited actions on behalf of the victim user. User interaction is required.