CVE-2025-0282: Ivanti Connect Secure unauthenticated RCE, exploited as a zero-day
The short version: Ivanti Connect Secure — the VPN formerly known as Pulse Connect Secure — has a stack-based buffer overflow (CVE-2025-0282) that lets an unauthenticated attacker execute code on the appliance. It was used as a zero-day against real customers before Ivanti had a patch, which means for this one, patching alone is not the whole job: you also need to check whether you were already hit. It's in CISA's KEV catalog. Steady hands — patch, then verify.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice and on paper |
| CVSS v3.1 (NVD) | 9.0 — Critical · AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
| EPSS | ~99.97% · 99.98th percentile (2026-07-16) |
| In CISA KEV? | Yes — remediation was due 2025-01-15 |
| Known exploited? | Yes — exploited as a zero-day prior to disclosure (Jan 2025) |
| Vulnerability type | CWE-121 stack-based buffer overflow → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Connect Secure ≤ 22.7R2.4 · Policy Secure ≤ 22.7R1.2 · Neurons for ZTA gateways ≤ 22.7R2.3 (9.x not affected) |
| Fixed in | Connect Secure 22.7R2.5 (Policy Secure / ZTA fixes followed on Ivanti's schedule) |
What you need to know
CVE-2025-0282 is a stack-based buffer overflow reachable without authentication on Ivanti Connect Secure. A remote attacker who can reach the VPN can overflow a buffer and gain remote code execution on the appliance.
The AC:H in the vector — "high attack complexity" — is why NVD lands at 9.0 rather than 9.8. Don't read that as comfort. In the real world, the complexity barrier didn't stop anyone: this was exploited in the wild as a zero-day against Connect Secure appliances before Ivanti disclosed it, and investigators tied that activity to malware families deployed on compromised devices.
Two details drive the priority:
- It's an unauthenticated flaw on a remote-access gateway. Compromise reaches past the box into the network it fronts.
- Exploitation predates the patch. An attacker may already have been on an exposed appliance before a fix existed — so applying the update doesn't retroactively evict them.
How serious we see it
Critical — and the modest-looking 9.0 doesn't soften it.
A VPN appliance, reachable from the internet, with unauthenticated code execution and confirmed zero-day exploitation is a top-of-queue item. The reassuring part is that it's bounded: it affects specific 22.x versions (the 9.x line isn't affected), fixes exist, and you can tell quickly whether it applies to you. The sharp edge is timing — because it was live before the patch, "we're patched" and "we're clean" are two different questions, and you need to answer both.
Recommendations
Straight from Ivanti's advisory and CISA:
- Patch now. Upgrade Connect Secure to 22.7R2.5 or later; apply the corresponding fixed releases for Policy Secure and Neurons for ZTA gateways per Ivanti's guidance.
- Run the Integrity Checker Tool (ICT). Ivanti's ICT can surface signs of exploitation. Note its limits — it's a point-in-time snapshot and a capable attacker may have restored the appliance to a clean-looking state.
- Assume nothing given the zero-day window — hunt. Review appliance and authentication logs for anomalous sessions and lateral movement in the period before you patched.
- If you find indicators, rebuild. Perform a factory reset / clean rebuild of the appliance rather than patching in place, then rotate all credentials, certificates, and secrets that touched it.
- Confirm your exposure first. Verify whether you have an internet-facing Ivanti Connect Secure / Policy Secure / ZTA gateway, and which version it runs.
How BreachRisk sees it
BreachRisk answers the "do we have one exposed, and is it a vulnerable version?" question first. From little more than your domain, it discovers your internet-facing appliances, fingerprints the Ivanti Connect Secure interface and its version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — surfaced at the top because it's in KEV.
We're honest about the line between discovery and forensics: BreachRisk shows you the exposed, vulnerable appliance from the outside — the attacker's view — so you know exactly where to point Ivanti's ICT and your hunt. A continuous outside-in view means a new zero-day disclosure doesn't send you searching for what you own; the exposure is already mapped.