CVE-2025-22457: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 4 Apr 2025, 1 day after the CVE record was published.
- How likely is exploitation in the next 30 days?
- 100%
EPSS score, percentile 100 of all scored records
- How severe?
- 9.0 Critical
CVSS v3.1 base score, given by the CNA
- What should I do?
CISA deadline 11 Apr 2025. Apply mitigations as set forth in the CISA instructions linked below.
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Unaffected 22.7R2.6; 22.7R1.4; 22.8R2.2
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
What to do
Required action, set by CISA
Apply mitigations as set forth in the CISA instructions linked below.
CISA due date for this action: 11 April 2025.
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
Linked from CISA's catalog entry
- https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-22457
- https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457
- https://nvd.nist.gov/vuln/detail/CVE-2025-22457
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Unaffected | 22.7R2.6 |
Versions not listed are: affected.
| Status | Versions |
|---|---|
| Unaffected | 22.7R1.4 |
Versions not listed are: affected.
| Status | Versions |
|---|---|
| Unaffected | 22.8R2.2 |
Versions not listed are: affected.
Versions the record lists as unaffected: 22.7R2.6, 22.7R1.4, 22.8R2.2.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
About this vulnerability
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.
Summary: CISA's KEV catalog, as of 28 Oct 2026.
- CISA added CVE-2025-22457 to its Known Exploited Vulnerabilities (KEV) catalog on 4 Apr 2025.
- CISA marks it as known to be used in ransomware campaigns.
- The due date CISA sets for the required action is 11 Apr 2025.
- The CVE record was published on 3 Apr 2025, 1 day before it was added to KEV.
- The CVE record carries a CVSS v3.1 base score of 9.0 (Critical), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 100% (percentile 100), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.
Description
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Weakness
- CWE-121: Stack-based Buffer Overflow
Attack patterns (CAPEC)
- CAPEC-100: Overflow Buffers
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| 3 Apr 2025 | CVE record published |
| 4 Apr 2025 | Added to CISA KEV |
| 11 Apr 2025 | CISA due date for the required action |
| 4 Aug 2026 | CVE record last updated |
References
More exploited Ivanti vulnerabilities
- CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
- CVE-2026-10520: Ivanti Sentry OS Command Injection Vulnerability
- CVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
- CVE-2026-1340: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
- CVE-2026-1603: Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
- CVE-2026-1281: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability