CVE-2022-35258

Deeper analysis

CVE-2022-35258 is a denial-of-service vulnerability affecting Ivanti Connect Secure in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure in versions prior to 9.1R17 and 22.3R1, and Ivanti Neurons for Zero-Trust Access in versions prior to 22.3R1. The flaw carries a CVSS 3.1 base score of 7.5 and is associated with CWE-128 and CWE-682; it permits an unauthenticated network attacker to disrupt service availability without any impact on confidentiality or integrity.

An unauthenticated remote attacker can exploit the issue over the network with low attack complexity to trigger a denial-of-service condition against the listed Ivanti products, resulting in loss of availability for affected appliances or services.

Vendor advisories referenced in SA45520 direct administrators to apply the fixed releases listed for each product line; the same advisory is published on the Ivanti knowledge base and contains the definitive remediation guidance and version mappings.

The associated EPSS score has remained essentially flat near 0.096, indicating no material post-disclosure increase in observed exploitation interest.