CVE-2025-22457: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Critical severity · published Apr 3, 2025

CVE-2025-22457

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

RansomwareIn wildKEV

9.8

CVSS

100%

EPSS

Yes

On KEV

Description

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)100.0% · higher than 100% of CVEs

Exploited in the wildYes

CISA KEVListed Apr 4, 2025

Federal remediation dueApr 11, 2025

Ransomware campaign useKnown

Affected products

Which versions

Connect Secure · Ivanti

before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7; +8 more · source: vendor, NVD

Neurons for ZTA gateways · Ivanti

All versions, or not specified · source: vendor

Policy Secure · Ivanti

before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7 · source: vendor, NVD

Zero Trust Access Gateway · Ivanti

before 22.8; 22.8; 22.8 · source: NVD

Connect Secure, Policy Secure, and ZTA Gateways · Ivanti

All versions, or not specified · source: KEV

Affected product

Connect Secure

Ivanti

All Connect Secure CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-22457

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-22457

CISA KEV catalogue

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

forums.ivanti.com

https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457