CVE-2025-0282
critical CISA KEVIvanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
Vendor / product: Ivanti — Connect Secure, Policy Secure, and ZTA Gateways
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
CVSS
9.0
9.0 (CVSS v3.1)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2025-01-08 23:15
Modified: 2026-10-01 19:17
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Listed in CISA KEV
Added 2025-01-08 · due 2025-01-15
Known ransomware use: Known
Required action (CISA)
Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.
Affected products
ivanti / connect_secure 22.7
ivanti / neurons_for_zero-trust_access 22.7
ivanti / policy_secure 22.7
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
References
- https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-... 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
- https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-da... af854a3a-2127-422b-91ae-364da2661108
- https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282 af854a3a-2127-422b-91ae-364da2661108
- https://github.com/sfewer-r7/CVE-2025-0282 134c704f-9b21-4f2e-91b3-4a467353bcc0
- https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-r... 134c704f-9b21-4f2e-91b3-4a467353bcc0
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0282 134c704f-9b21-4f2e-91b3-4a467353bcc0
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-... 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
CISA KEV — fetched 2026-10-27 06:50 UTC · record ↗
NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗