Ivanti Releases Security Updates for Connect Secure, Policy Secure & ZTA Gateways Vulnerability (CVE-2025-22457)

Ivanti released security updates to address vulnerabilities CVE-2025-22457 in Ivanti Connect Secure, Policy Secure & ZTA Gateways. A cyber threat actor could exploit CVE-2025-22457 to take control of an affected system. CISA has added CVE-2025-22457 to its Known Exploited Vulnerabilities Catalog...

Critical Ivanti Flaw Actively Exploited to Deploy TRAILBLAZE and BRUSHFIRE Malware

Ivanti has disclosed details of a now-patched critical security vulnerability impacting its Connect Secure product that has come under active exploitation in the wild. The vulnerability, tracked as CVE-2025-22457 CVSS score: 9.0, concerns a case of a stack-based buffer overflow that could be...

The vulnerability of Ivanti Connect Secure, Ivanti Policy Secure, and ZTA Gateways’ network access control devices lies in buffer overflows in the stack, allowing attackers to execute arbitrary code.

The vulnerability of Ivanti Connect Secure, Ivanti Policy Secure, and ZTA Gateways lies in buffer overflow in the stack. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Ivanti Connect Secure CVE-2025-22457 exploited in the wild

On Thursday, April 3, 2025, Ivanti disclosed a critical severity vulnerability affecting Ivanti Connect Secure, Pulse Connect Secure, Policy Secure, and ZTA Gateways. CVE-2025-22457 is a stack-based buffer overflow vulnerability that allows remote, unauthenticated attackers to execute code on the...

CVE-2025-22457

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution...

CVE-2025-22457

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution...

CVE-2025-22457

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution...

CVE-2025-22457

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution...

CVE-2025-22457

CVE-2025-22457 is a stack-based buffer overflow in Ivanti Connect Secure family (affecting Ivanti Connect Secure prior to 22.7R2.6, Ivanti Policy Secure prior to 22.7R1.4, and Ivanti ZTA Gateways prior to 22.8R2.2) that enables remote code execution by a remote unauthenticated attacker. Affected ...

Vulnerability fixed in Ivanti Connect Secure, Policy Secure and ZTA Gateways

Ivanti has fixed a vulnerability in Connect Secure, Policy Secure and ZTA Gateways. A malicious party could exploit the vulnerability to execute arbitrary code on the vulnerable system without prior authentication. Ivanti reports having information that the vulnerability has been exploited on...

CVE-2025-22457: Stack-based Buffer Overflow

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution...

PT-2025-14768

Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions prior to 22.7R2.6 Ivanti Policy Secure versions prior to 22.7R1.4 Ivanti ZTA Gateways versions prior to 22.8R2.2 Pulse Connect Secure versions 9.x Description A stack-based buffer overflow in the HTTPS web server...

VulnCheck KEV: CVE-2025-22457

Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution...

The vulnerability of the Ivanti Connect Secure and Ivanti Policy Secure network access control devices, related to the handling of the zero pointer, allows a violator to trigger a service failure.

The vulnerability of the Ivanti Connect Secure and Ivanti Policy Secure network access control tools is related to the handling of the zero pointer. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

The vulnerability of Ivanti Connect Secure and Ivanti Policy Secure, which are network access control tools, stems from insecure privilege management. This allows attackers to elevate their privileges.

The vulnerability of the Ivanti Connect Secure and Ivanti Policy Secure network access control tools is related to insecure management of privileges. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of Ivanti Connect Secure and Ivanti Policy Secure, which are network access control tools, stems from buffer overflow in the stack. This allows a malicious user to trigger a service failure.

The vulnerability of Ivanti Connect Secure and Ivanti Policy Secure network access control tools is related to buffer overflow in the stack. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

CVE-2024-38657

External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to write arbitrary files...

CVE-2024-38657

External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to write arbitrary files...

CVE-2024-38657

External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to write arbitrary files...

CVE-2024-38657

CVE-2024-38657 affects Ivanti Connect Secure not newer than 22.7R2.4 and Ivanti Policy Secure not newer than 22.7R1.3. A remote authenticated attacker with admin privileges can write arbitrary files via external control of a file name. Remediation: update to supported fixed versions (ICS 22.7R2.4...