CVE-2025-22457

A critical vulnerability has been identified in several Ivanti products, specifically those related to secure access and policy management. This vulnerability manifests as a stack-based buffer overflow, which occurs when a program writes more data to a buffer located on the stack than it can hold. This overflow can lead to the corruption of adjacent memory, potentially allowing an attacker to execute arbitrary code. The affected versions include Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti ZTA Gateways prior to their respective patch releases. The severity of this vulnerability is underscored by its high CVSS score of 9.8, indicating a critical risk that necessitates immediate attention.

Attack vectors for exploiting this vulnerability are particularly concerning due to the ability for remote unauthenticated attackers to execute code without requiring any form of authentication. This means that an attacker could potentially exploit the vulnerability from anywhere on the internet, making it a prime target for malicious actors. Exploitation could be achieved through crafted requests sent to the affected systems, which would manipulate the stack memory and allow the attacker to gain control over the system. Given the nature of the affected products, the implications of such an attack could range from unauthorized access to sensitive data to complete system compromise.

The real-world impact of this vulnerability can be devastating for organizations relying on Ivanti's solutions for secure access and policy enforcement. Successful exploitation could lead to data breaches, loss of sensitive information, and significant disruptions to business operations. The financial repercussions could be severe, including costs associated with incident response, legal liabilities, and potential regulatory fines. Furthermore, the reputational damage resulting from a breach could erode customer trust and lead to long-term consequences for the affected organization. The interconnectedness of modern IT environments means that the ramifications of such an exploit could extend beyond the immediate victim, potentially impacting partners and clients as well.

To effectively detect and mitigate this vulnerability, organizations should implement a multi-faceted approach. Regularly updating and patching affected systems is paramount; organizations should prioritize applying the latest security updates provided by Ivanti. Additionally, employing intrusion detection systems (IDS) can help identify and alert on suspicious activities that may indicate an attempted exploitation of the vulnerability. Network segmentation and strict access controls can also limit the potential impact of an attack, ensuring that even if a system is compromised, the attacker’s ability to move laterally within the network is restricted. Continuous monitoring and incident response planning are essential components of a robust security posture, enabling organizations to respond swiftly to any signs of compromise.

In conclusion, the stack-based buffer overflow vulnerability in Ivanti's secure access and policy management products represents a significant threat to organizations that utilize these systems. The potential for remote code execution by unauthenticated attackers poses a critical risk, necessitating immediate action to mitigate the threat. By prioritizing patch management, employing detection mechanisms, and enhancing overall security practices, organizations can better protect themselves against the exploitation of this vulnerability and safeguard their sensitive data and operations.

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting CVE-2025-22457, accompanied by the emergence of a new ransomware group linked to this vulnerability. Although the CVSS score was slightly adjusted downward to 9.0, the vulnerability remains critical due to its remote unauthenticated code execution capability. Our telemetry indicates an increased prevalence of publicly available proof-of-concept exploits, including enhanced Metasploit modules that improve attacker accessibility. The EPSS score’s modest rise further underscores the growing likelihood of exploitation in the wild. The addition of a new ransomware actor to the known threat landscape signals expanding adversary interest and potential for more aggressive campaigns leveraging this flaw. Collectively, these developments elevate the urgency for defenders to monitor for exploitation indicators and reassess risk posture, as the threat environment surrounding Ivanti Connect Secure and related products continues to intensify.

Update 2 — June 09, 2026

Recent CSURFACE threat intelligence reveals a further increase in the exploitability and operational use of CVE-2025-22457. The CVSS score adjustment to 9.8 reflects a refined understanding of the vulnerability’s criticality, now recognized as highly likely to enable remote code execution without authentication. Concurrently, the EPSS score’s upward trend signals a growing probability of exploitation attempts in the wild. Our telemetry indicates a marked escalation in the availability and sophistication of proof-of-concept exploits, including enhanced Metasploit modules that facilitate attacker access by automating complex memory manipulation techniques. Additionally, the ransomware landscape associated with this vulnerability has expanded, with new groups joining established actors in leveraging this flaw for high-impact campaigns. This broadening adversary interest underscores an elevated threat environment, where exploitation attempts are becoming more frequent and potentially more damaging. Consequently, the risk level for organizations running affected Ivanti products has intensified, necessitating heightened vigilance and prioritization of detection capabilities to identify early indicators of compromise linked to this vulnerability.

Update 3 — June 20, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2025-22457, accompanied by a near-maximal increase in the Exploit Prediction Scoring System (EPSS) score. This surge reflects a rapidly intensifying adversary focus, corroborated by the emergence of multiple new proof-of-concept exploits and an active Metasploit module facilitating remote code execution against vulnerable Ivanti Connect Secure versions. The ransomware ecosystem linked to this vulnerability continues to expand, with additional groups integrating this exploit into their campaigns, thereby broadening the threat actor landscape. For defenders, this heightened activity signals an elevated risk of compromise, as exploitation is becoming more accessible and widespread. The combination of increased telemetry detections and enhanced exploit availability significantly raises the urgency for detection and response capabilities. Consequently, the overall threat level associated with CVE-2025-22457 has escalated to critical, underscoring the necessity for continuous monitoring and rapid incident response readiness.

Update 4 — July 10, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation activity targeting CVE-2025-22457, evidenced by a discernible rise in telemetry detections and the emergence of new proof-of-concept exploits circulating within attacker communities. This expansion of the exploit landscape, coupled with the integration of this vulnerability into ransomware campaigns by groups such as 0apt and ransomhub, amplifies the operational risk for organizations running affected Ivanti products. The slight uptick in the Exploit Prediction Scoring System (EPSS) score, now approaching certainty, reflects the increasing likelihood of successful exploitation attempts in the wild. For defenders, these developments signify a heightened threat environment where adversaries possess greater capability and motivation to leverage this critical remote code execution flaw. Consequently, the overall threat level associated with CVE-2025-22457 has intensified, underscoring the imperative for enhanced detection and rapid response measures to mitigate potential compromise.