Ivanti · Connect Secure, Policy Secure, and ZTA Gateways
CVE-2025-0282
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
What it is
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
CISA: Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.
What to do
Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.
Deadline for US federal agencies: January 15, 2025
More exploited flaws from Ivanti
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Apr 4, 2025 | Stack-Based Buffer Overflow | Connect Secure, Policy Secure, and ZTA Gateways | Critical 9.0 | >99.9% |
| Oct 13, 2026 | Authentication Bypass by Spoofing | Connect Secure | High 8.6 | 87% |
| Jun 11, 2026 | OS Command Injection | Sentry | Critical 10.0 | 99.9% |
| May 7, 2026 | Improper Input Validation | Endpoint Manager Mobile (EPMM) | High 7.2 | 34% |
| Apr 8, 2026 | Code Injection | Endpoint Manager Mobile (EPMM) | Critical 9.8 | 99% |
| Mar 9, 2026 | Endpoint Manager (EPM) Authentication Bypass | Endpoint Manager (EPM) | High 8.6 | 88% |
| Jan 29, 2026 | Code Injection | Endpoint Manager Mobile (EPMM) | Critical 9.8 | 99% |
| May 19, 2025 | Authentication Bypass | Endpoint Manager Mobile (EPMM) | Medium 5.3 | 99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.