Patchfirst
Patchfirst
CVE-2025-22457 KEVRansomwarePublic exploit Critical · 9.8 EPSS >99.9%

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Ivanti · Connect Secure, Policy Secure, and ZTA Gateways

Summary

A stack-based buffer overflow in Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti ZTA Gateways allows a remote attacker to execute arbitrary code on the affected gateway. No authentication, user interaction, or special configuration is required, as the flaw is reachable over the network.

Official description · NVD

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.

Breakdown
83.7 / 100
Exploited
Yes, in CISA KEV
Reports
1
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited the day it was disclosed. Public exploit code (Metasploit) was available the same day.

  1. DisclosedFirst seen exploitedVulnCheck KEV evidencePublic exploit codeMetasploitday 0
  2. Added to CISA KEVknown ransomware use; EU database agrees+1 day

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order 2

Initial AccessTA0001

Exploit Public-Facing Application T1190
MITRE CTID mapping of the KEV entry · how it is exploited

Ivanti Connect Secure, Pulse Connect Secure, Ivanti Policy Secure, and ZTA Gateways products running old versions are susceptible to a stack-based buffer overflow exploit that can lead to remote code execution. The patched versions of each product that remove this vulnerability are as follows: Ivanti Connect Secure (22.7R2.6), Pulse Connect Secure (22.7R2.6), Ivanti Policy Secure (22.7R1.4), and ZTA Gateways (22.8R2.2).

ExecutionTA0002

Command and Scripting Interpreter T1059
MITRE CTID mapping of the KEV entry · primary impact

Detection

0 rules for this CVE · 244 general rules for its techniques

Rules for this CVE

0 that reference CVE-2025-22457 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗
Command and Scripting InterpreterT105995 general rules
All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report
1 reportpicussecurity.com

Reports are matched by finding the exact id CVE-2025-22457 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag

Vendor Advisory 1

forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22457
↑ ↓ chooseEnter openEsc close