CVE-2025-22457 kev+ ransomware in the critical feed json
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZT…
published 2025-04-03 19 mo ago modified 2026-08-04 3 mo ago also EUVD-2025-9646
- cvss
- 9.0
- version 3.1, CNA
- cisa kev
- Exploited
- added 2025-04-04, used in ransomware
- epss
- 100.0%
- EPSS 100.0% chance of exploitation in 30 days, percentile 99.9%
- public exploits
- 1
- Metasploit
Summary
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.
Patch / fix
cisa required action Apply mitigations as set forth in the CISA instructions linked below.
- Ivanti Connect Secure 22.7R2.6
- Ivanti Policy Secure 22.7R1.4
- Ivanti Neurons for ZTA gateways 22.8R2.2
Timeline
- CISA SSVC: exploitation active
- First public exploit (Metasploit exploit/linux/http/ivanti_connect_secure_stack_overflow_rce_cve_2025_22457)
- Published
- Added to CISA KEV
- CISA patch deadline
Known exploited
- Added
- 19 mo ago
- Patch by
- 2025-04-11 (18 mo ago)
- Ransomware
- Known to be used in ransomware campaigns
- Required action
- Apply mitigations as set forth in the CISA instructions linked below.
- Vendor, product
- Ivanti, Connect Secure, Policy Secure, and ZTA Gateways
- CISA name
- Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
ATT&CK techniques
How it is exploited and what it leads to, in MITRE ATT&CK terms.
- T1190 Exploit Public-Facing Application exploitation
- T1059 Command and Scripting Interpreter primary impact
kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 19 mo ago
Exploit prediction
99.98% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/linux/http/ivanti_connect_secure_stack_overflow_rce_cve_2025_22457 Ivanti Connect Secure Unauthenticated Remote Code Execution via Stack-based Buffer Overflow metasploit exploit, great rank, 2025-04-03
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Ivanti Connect Secure
- Ivanti Policy Secure
- Ivanti Neurons for ZTA gateways
Classification
- Weakness
- Technology feeds
References
-
forums.ivanti.com
/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457
vendor-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22457
government-resource, us-government-resource
Sources
- CVE List CVE-2025-22457
- NVD CVE-2025-22457
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.