Policy Secure vulnerabilities | LiveThreat CVE Feed

Product

Policy Secure

by Ivanti · last CVE Sep 9, 2025

On CISA KEVExploited in the wildRansomware-linked

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities77 In the news0 Timeline

Severity mix

Critical 8High 36Medium 31Low 2

Severity

All severities77 Critical8 High36 Medium31 Low2

Exploitation

On CISA KEV8 Exploited in the wild8

Watch

Add Policy Secure to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-22457 RansomwareIn wildKEV	9.8	100%	Apr 3	Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability Affected: before 22.7; 22.7; 22.7; 22.7; 22.7; 22.7
CVE-2024-21887 RansomwareIn wildKEV	9.1	100%	Jan 12	Ivanti Connect Secure and Policy Secure Command Injection Vulnerability Affected: 9.0; 9.1; 9.1; 9.1; 9.1; 9.1; +31 more
CVE-2025-0282 RansomwareIn wildKEV	9.0	100%	Jan 8	Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability Affected: 22.7R1 through 22.7R1.2
CVE-2024-21894	9.8	19%	Apr 4	A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted… Affected: 9.0; 9.0; 9.0; 9.0; 9.0; 9.0; +26 more
CVE-2024-39712	9.1	2%	Nov 13	Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7
CVE-2024-39711	9.1	2%	Nov 13	Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with… Affected: before 22.7; 22.7; 22.7; 22.7
CVE-2024-39710	9.1	2%	Nov 13	Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7
CVE-2024-38656	9.1	2%	Nov 13	Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin… Affected: before 22.7; 22.7; 22.7; 22.7