Stack-based buffer overflow in Ivanti Connect Secure, Policy Secure, and ZTA Gateways (CVE-2025-22457)

A stack-based buffer overflow vulnerability exists in Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti ZTA Gateways. A remote unauthenticated attacker can exploit this vulnerability to achieve remote code execution. Active exploitation has been observed against Ivanti Connect Secure 22.7R2.5 or earlier and end-of-support Pulse Connect Secure 9.1x appliances. ⚠️ Actively exploited in the wild (CISA KEV). Affected versions: - Ivanti Connect Secure 22.7R2.5 and earlier - Pulse Connect Secure 9.x (end-of-support as of December 31, 2024) We recommend updating to: Ivanti Connect Secure 22.7R2.6. CVSS 9.8 · our assessment: emergency Reference: https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457 Details: https://vuln.today/cve/CVE-2025-22457