CVE-2025-0282
CISA KEV RANSOMWARE
ACT NOW
Priority: 0.00
BB Relevance:
10/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.
CISA Known Exploited Vulnerability
Vendor / Product
Ivanti — Connect Secure, Policy Secure, and ZTA Gateways
Date Added
2025-01-08
Remediation Due
2025-01-15
Ransomware Use
CONFIRMED
CISA Mitigation Instructions: https://www.cisa.gov/cisa-mitigation-instructions-CVE-2025-0282 Additional References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283 ; https://nvd.nist.gov/vuln/detail/CVE-2025-0282
Affected Software (11)
| Vendor | Product | Version |
|---|---|---|
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | neurons_for_zero-trust_access | 22.7 |
| ivanti | neurons_for_zero-trust_access | 22.7 |
| ivanti | neurons_for_zero-trust_access | 22.7 |
| ivanti | policy_secure | 22.7 |
| ivanti | policy_secure | 22.7 |
| ivanti | policy_secure | 22.7 |
References & Advisories (7)
Vendor Advisory
US Government Resource
US Government Resource
Third Party Advisory
US Government Resource
Exploit
Third Party Advisory
Exploit
Technical Description
Exploit