What’s Vulnerable › Vulnerabilities

CVE-2025-0282: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

• Severity: critical (CVSS 9.0 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2025-01-08
• EPSS: 100.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-01-08 · updated 2026-10-01
• Weakness: CWE-121

Description

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.

Summary

CVE-2025-0282 is a critical (CVSS 9) stack-based buffer overflow in Ivanti Connect Secure before 22.7R2.5, Ivanti Policy Secure before 22.7R1.2, and Ivanti Neurons for ZTA gateways before 22.7R2.3, allowing a remote unauthenticated attacker to execute code. It is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, a public exploit or detection template exists, and EPSS puts 30-day exploitation probability at 100%. Apply the vendor updates to the versions listed above and follow CISA instructions, including hunting and remediation, before returning any device to service.

CVE-2025-0282 هو ثغرة تجاوز سعة المخزن المؤقت على المكدس (stack-based buffer overflow) حرجة بدرجة CVSS 9 في Ivanti Connect Secure قبل الإصدار 22.7R2.5، وIvanti Policy Secure قبل الإصدار 22.7R1.2، وبوابات Ivanti Neurons for ZTA قبل الإصدار 22.7R2.3، وتتيح لمهاجم عن بُعد غير مصادَق عليه تنفيذ تعليمات برمجية عن بُعد. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة بالاستغلال مع استغلال نشط، ويوجد استغلال عام أو قالب كشف، وتشير EPSS إلى احتمال استغلال بنسبة 100% خلال 30 يومًا. طبّق التحديثات المذكورة أعلاه واتبع تعليمات CISA بما في ذلك أنشطة البحث والتحقق والمعالجة قبل إعادة أي جهاز إلى الخدمة.

Affected products

• Ivanti Connect Secure (Pulse Secure): 22.7-r2, 22.7-r2.1, 22.7-r2.2, 22.7-r2.3, 22.7-r2.4
• Ivanti Neurons For Zero-Trust Access: 22.7-r2, 22.7-r2.2, 22.7-r2.3
• Ivanti Policy Secure: 22.7-r1, 22.7-r1.1, 22.7-r1.2

References

• https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283
• https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day
• https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282
• https://github.com/sfewer-r7/CVE-2025-0282
• https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0282
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-0282

Get alerted when CVE-2025-0282 or the next vulnerability affects your stack