Summary
generated automatically from NVD dataCVE-2025-0282 is a stack-based buffer overflow (CWE-121) in Ivanti Connect Secure, Ivanti Policy Secure and Ivanti Neurons for ZTA gateways. A remote, unauthenticated attacker can exploit it to achieve remote code execution. The flaw affects Connect Secure before 22.7R2.5, Policy Secure before 22.7R1.2 and Neurons for ZTA gateways before 22.7R2.3. It is rated CVSS 9.0 (CRITICAL), is listed in the CISA KEV catalog since 2025-01-08, and has known use in ransomware campaigns.
NVD description
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2025-01-08. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2025-01-15
Used in known ransomware campaigns.
EPSS · FIRST.org
100.0%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 8 janv. 2025
- Updated
- 1 oct. 2026
- Status
- Analyzed
- Source
- 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
Affected products
Weaknesses (CWE)
References (7)
- https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-dayExploitTechnical Description
- https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282Third Party AdvisoryUS Government Resource
- https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0282US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-121
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.