CVE-2025-0282: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
Vulnerability summary
CVE-2025-0282 is a critical (CVSS 9.0) Stack-based Buffer Overflow vulnerability in Ivanti Connect Secure, Policy Secure, and ZTA Gateways. It is known to be exploited: CISA lists it, first on 08-01-2025. It has been used in ransomware campaigns. EPSS estimates a 99.98% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 4 public exploits are recorded.
Timeline
- 08-01-2025PublishedVulnerability first disclosed.
- 08-01-2025Added to CISA KEVIvanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
- 15-01-2025CISA remediation dueApply mitigations per vendor instructions.
- 01-10-2026Last modifiedVulnerability information updated.
Description
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST9.0CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
99.98%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 99.98% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 08-01-2025
- Federal due date
- 15-01-2025
CISA required action
Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service. nvd.nist.gov/vuln/detail/CVE-2025-0282
Public exploits
4 foundCve 2025 0282
Maturity: poc
Exploit Reference (labs.watchtowr.com)
Maturity: unknown
Exploit Reference (cloud.google.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Ivanti4 products
- connect_secure≥ 22.7R2, ≤ 22.7R2.4 | 22.7:r2 | 22.7:r2.1 | 22.7:r2.2 | 22.7:r2.3 | 22.7:r2.4
- neurons_for_zero-trust_access22.7:r2 | 22.7:r2.2 | 22.7:r2.3
- neurons for zta gateways≥ 22.7R2, ≤ 22.7R2.3
- policy_secure≥ 22.7R1, ≤ 22.7R1.2 | 22.7:r1 | 22.7:r1.1 | 22.7:r1.2
1 vendor · 4 products
References
7 links- forums.ivanti.com/s/…Vendor Advisory
- labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/Third Party AdvisoryExploit
- www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-0282Government ResourceUS Government Resource
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0282Government ResourceUS Government Resource
- cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-dayExploitTechnical Description