CVE-2025-0282

A critical vulnerability has been identified within Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for Zero Trust Access gateways, specifically a stack-based buffer overflow. This flaw arises from improper handling of input data, allowing an attacker to overflow the stack memory. When an application fails to adequately validate or limit the size of input data, it can lead to overwriting adjacent memory, potentially allowing an attacker to execute arbitrary code. The affected versions of these products are prior to 22.7R2.5 for Connect Secure, 22.7R1.2 for Policy Secure, and 22.7R2.3 for Neurons for Zero Trust Access. The severity of this vulnerability is underscored by its high CVSS score of 9.0, indicating a critical risk to systems utilizing these products.

Attack vectors for exploiting this vulnerability are particularly concerning due to the potential for remote unauthenticated access. An attacker could leverage this flaw by sending specially crafted requests to the affected systems, which could lead to remote code execution. This means that an attacker does not need to authenticate or have prior access to the network, significantly lowering the barrier to entry for exploitation. Scenarios may include an attacker targeting a vulnerable system within a corporate network or even from an external location, depending on the network configuration. Successful exploitation could allow the attacker to gain control over the affected device, leading to unauthorized access to sensitive data or further infiltration into the network.

The real-world impact of this vulnerability is profound, particularly for organizations that rely on Ivanti's solutions for secure access and policy enforcement. The ability for an attacker to execute arbitrary code remotely can lead to severe business risks, including data breaches, loss of sensitive information, and disruption of services. Furthermore, the exploitation of this vulnerability could facilitate lateral movement within an organization’s network, allowing attackers to compromise additional systems and escalate their privileges. The reputational damage and financial implications of such incidents can be substantial, as organizations may face regulatory scrutiny and loss of customer trust.

To address this vulnerability, organizations must prioritize detection and mitigation strategies. Regularly updating and patching affected systems is crucial; organizations should ensure they are running the latest versions of Ivanti products that have addressed this vulnerability. Additionally, implementing network segmentation can help limit the exposure of vulnerable systems to potential attackers. Intrusion detection systems (IDS) and intrusion prevention systems (IPS) can also be deployed to monitor for unusual activity that may indicate an attempted exploitation of this vulnerability. Regular security assessments and penetration testing should be conducted to identify and remediate vulnerabilities before they can be exploited.

In conclusion, the stack-based buffer overflow vulnerability in Ivanti's products poses a significant threat to organizations utilizing these solutions. The potential for remote code execution by unauthenticated attackers necessitates immediate attention and action. By understanding the technical details, attack vectors, and real-world implications of this vulnerability, organizations can better prepare their defenses and mitigate the associated risks. Proactive measures, including timely updates and robust security practices, are essential to safeguarding sensitive data and maintaining the integrity of critical systems.

CSURFACE threat intelligence has detected a marked escalation in activity related to CVE-2025-0282, with new exploitation attempts emerging in the wild. Our telemetry indicates the first confirmed sighting of active exploitation, signaling that threat actors have moved from proof-of-concept testing to operational use. Additionally, the number of ransomware groups linked to this vulnerability has expanded, now including a newly identified actor alongside previously known groups such as Akira and Ransomhub. This broadening of adversary interest underscores the vulnerability’s attractiveness as a vector for initial access and lateral movement in ransomware campaigns. Although the EPSS score remains high, the slight downward trend suggests some variability in exploit attempts; however, the introduction of new ransomware actors and the sharp increase in detection activity elevate the overall threat level. Defenders should interpret these developments as an indication that CVE-2025-0282 is transitioning into an actively exploited, high-risk threat, warranting heightened vigilance and prioritization in vulnerability management programs.

Update 2 — June 19, 2026

CSURFACE threat intelligence has identified a marked escalation in detection activity related to CVE-2025-0282, with telemetry indicating a doubling in exploit attempts over a short period. This surge coincides with the vulnerability’s recent inclusion in the Known Exploited Vulnerabilities (KEV) catalog, underscoring its growing prominence as a target for threat actors. The EPSS score has risen further, nearing certainty of exploitation, reflecting increased attacker interest and operationalization. Notably, multiple new proof-of-concept exploits have emerged publicly, lowering the barrier for adversaries to weaponize this flaw. Concurrently, ransomware groups such as akira, ransomhub, and sinobi continue to be linked with campaigns leveraging this vulnerability, reinforcing its role as a preferred vector for initial access and lateral movement in ransomware operations. This convergence of factors elevates the threat level from high to critical, signaling that CVE-2025-0282 is transitioning into an actively exploited and prioritized risk. Defenders should interpret this as a clear indicator that exploitation attempts will likely intensify, necessitating urgent attention within vulnerability management and detection strategies.

Update 3 — July 09, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2025-0282, evidenced by a notable increase in telemetry activity. This uptick reflects growing adversary interest and operational momentum, coinciding with the continued public availability of multiple proof-of-concept exploits. The persistence of ransomware groups such as akira, ransomhub, and sinobi leveraging this vulnerability underscores its strategic value for initial access and lateral movement within compromised environments. Although the EPSS score remains near maximum and stable, the increased detection frequency signals a shift from theoretical risk to active exploitation. Consequently, the threat level associated with CVE-2025-0282 should be considered elevated to critical, emphasizing the urgency for defenders to prioritize detection and response efforts around this vulnerability.