Vulnerabilities/Ivanti/CVE-2025-0282
CVE-2025-0282: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC
Exploitation confirmedRansomware use knownPatch available
CVSS 3.1 · NVD9.0Critical
EPSS100.0%100th percentile · 29 Oct 2026
CISA KEVListedAdded 8 Jan 2025
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.
Recommended action
Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.
CISA due date 15 Jan 2025 · CWE-121
Am I affected?
| Product | Affected versions | Fixed in |
|---|---|---|
| Connect Secure | 22.7R2 to 22.7R2.4 | 22.7R2.5 |
| Connect Secure | 22.7R2.5 | 22.7R2.5 |
| Policy Secure | 22.7R1 to 22.7R1.2 | Unknown |
| Neurons for ZTA gateways | 22.7R2 to 22.7R2.3 | 22.7R2.5 |
| Neurons for ZTA gateways | 22.7R2.5 | 22.7R2.5 |
Before you patch
Restart
See vendor guidance.Known issues
Check release notes.Verification
Confirm installed version.Timeline
- 8 Jan 2025 · Added to CISA KEV
- 15 Jan 2025 · CISA due date
Sources checked
| CISA KEV | 30 Oct 2026, 12:10 UTC |
| CVE List v5 | 30 Oct 2026, 12:10 UTC |
| NVD | 30 Oct 2026, 12:10 UTC |
| FIRST EPSS | 30 Oct 2026, 12:11 UTC |
Data from CISA, MITRE, NVD and FIRST. Sources and licences.