CVE-2025-0282: critical vulnerability in Ivanti Connect Secure
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.
A flaw in Ivanti Connect Secure, Policy Secure, and Neurons for ZTA allows attackers to overflow a memory buffer and execute arbitrary code on the system without needing to log in. This is critical because it gives attackers complete control over vulnerable servers.
Stack-based buffer overflow in affected Ivanti gateway products allows remote unauthenticated attackers to corrupt the call stack and achieve arbitrary code execution. The vulnerability requires no authentication and can be exploited via network access to the vulnerable service, posing immediate risk to exposed instances.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.