Actively exploited · Published Apr 3, 2025 · Assigned by ivanti
CVE-2025-22457
Critical 9.0 Exploited Ransomware
In plain English
A critical-severity stack buffer overflow in Connect Secure from Ivanti. Attackers are actively exploiting it in the wild (listed by CISA on April 4, 2025). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Apply mitigations as set forth in the CISA instructions linked below.
CISA guidance
Apply mitigations as set forth in the CISA instructions linked below.
Federal agencies must remediate by Apr 11, 2025.
Official description
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ivanti | Connect Secure | see references |
| Ivanti | Policy Secure | see references |
| Ivanti | Neurons for ZTA gateways | see references |
Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H