A missing authorization vulnerability in Ivanti secure access products allows authenticated attackers with read-only privileges to perform unauthorized configuration changes, posing a significant security risk.

The vulnerability is a missing authorization flaw (CWE-862) that permits a remote attacker who has already obtained read-only administrative privileges to improperly configure authentication-related settings, effectively escalating their control over the environment.

Successful exploitation of this flaw could allow an attacker with limited administrative access to modify authentication parameters, potentially leading to unauthorized access, account takeover, or the bypass of security controls. With a CVSS score of 8.8, this vulnerability is classified as High severity, as it facilitates the compromise of core identity and access management functions within the affected network infrastructure.

Immediate Action: Organizations must update the affected Ivanti software to the specified fixed versions: Connect Secure (22.7R2.9 or 22.8R2), Policy Secure (22.7R1.6), ZTA Gateway (2.8R2.3-723), and Neurons for Secure Access (22.8R1.4).

Proactive Monitoring: Security teams should audit administrative access logs for unusual configuration changes, particularly those involving authentication or identity provider settings, originating from read-only service accounts.

Compensating Controls: Restrict administrative interface access to known, trusted management IP addresses and implement multi-factor authentication for all administrative sessions to limit the utility of compromised read-only credentials.

Public Exploit Available: Unknown.

Given the potential for privilege escalation and the critical nature of the affected Ivanti gateway products, patching should be prioritized immediately. Organizations should verify their current versions against the vendor advisory and initiate the update process to prevent potential exploitation of their authentication infrastructure.