CVE-2025-22457

critical-risk
Published 2025-04-03

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.

Do I need to act?

!
53.7% chance of exploitation in next 30 days
EPSS score — higher than 46% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.0/10 Critical
NETWORK / HIGH complexity

Affected Products (20)

Affected Vendors

Ivanti

References (2)

Vendor Advisory https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secur...
US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-...
72
/ 100
critical-risk
Severity 26/34 · High
Exploitability 25/34 · High
Exposure 21/34 · High