CVE-2025-0282: Ivanti Connect Secure stack buffer overflow enables unauthenticated RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.0, unauthenticated network-reachable RCE on edge VPN/ZTNA appliances, KEV-listed with known ransomware use and near-maximum EPSS.

What it is

A stack-based buffer overflow (CWE-121/CWE-787) in Ivanti Connect Secure, Policy Secure and Neurons for ZTA gateways lets a remote, unauthenticated attacker execute code. The flaw is remotely reachable over the network and carries a CVSS 3.1 base score of 9.0 (critical). Because these are edge VPN/ZTNA appliances, successful exploitation gives an attacker a foothold inside the perimeter.

Impact

An attacker gains remote code execution on the gateway, which can lead to full compromise of the appliance and access to internal networks and credentials handled by it. CISA's KEV entry notes known ransomware campaign use, so downstream impact can include lateral movement and ransomware deployment.

Attack surface

Reachable over the network (AV:N) with no privileges (PR:N) and no user interaction (UI:N), so any internet-exposed instance of the affected products is a candidate target. The only friction noted in the vector is high attack complexity (AC:H).

Exploitation

Listed in CISA KEV since 2025-01-08 with a 2025-01-15 remediation due date and flagged for known ransomware campaign use; EPSS 30-day probability is 0.99979 (99.98th percentile). Multiple references are tagged Exploit, including vendor-adjacent and third-party technical walkthroughs, indicating public exploitation detail exists.

What to do

• Apply the vendor updates that move Connect Secure to 22.7R2.5 or later, Policy Secure to 22.7R1.2 or later, and Neurons for ZTA gateways to 22.7R2.3 or later.
• Follow the CISA mitigation instructions, including conducting hunt activities and remediation before returning any device to service.
• Until patched, remove or restrict internet exposure of affected gateways and enforce strict access controls on management interfaces.
• Assume compromise for any unpatched, internet-facing instance and perform integrity checks and credential rotation before trusting the device again.
• Monitor vendor and CISA advisories for updated guidance, as the KEV entry references additional mitigation steps.

Detection

• Hunt for exploitation attempts and post-exploitation activity against Ivanti gateways using the technical indicators in the Google Cloud and WatchTowr analyses.
• Review gateway logs for unexpected process execution, crashes, or anomalous child processes consistent with a buffer overflow and code execution.
• Check for unauthorized configuration changes, new accounts, or persistence artifacts on the appliances, and validate system file integrity.
• Correlate network telemetry for inbound requests to the vulnerable service from untrusted sources, especially around the KEV publication window.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.