What is the CVSS score of CVE-2025-22457?

CVE-2025-22457 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 53.7%.

Which versions of Ivanti Connect Secure are affected by CVE-2025-22457?

Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a critical remote code execution vulnerability confirmed actively exploited (CISA KEV), with no vendor patch currently available.

Is there a public PoC exploit available for CVE-2025-22457?

Yes, a public proof-of-concept exploit is available for CVE-2025-22457. Prioritise patching immediately. EPSS: 53.7%.

How to fix or mitigate CVE-2025-22457?

Within 24 hours: Implement immediate logging and alerting to detect exploitation attempts targeting CVE-2025-22457, document your current Ivanti product versions and network scope, and restrict administrative access to these gateways to authorized IP ranges only. Within 7 days: Deploy network-based mitigations including WAF and IDS rules to detect and block stack buffer overflow payloads; implement network segmentation to isolate affected gateways from critical systems; and establish additional authentication layers or access proxies for gateway management. Within 30 days: Execute emergency patching immediately when Ivanti releases fixes (Connect Secure version 22.7R2.6+, Policy Secure version 22.7R1.4+, ZTA Gateways version 22.8R2.2+); evaluate temporary replacement appliances if operations are business-critical; and conduct forensic analysis to identify evidence of prior unauthorized access to compromised gateways.

Ivanti Connect Secure CVE-2025-22457

CRITICAL

Stack-based Buffer Overflow (CWE-121)

2025-04-03 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Ivanti Buffer Overflow RCE Stack Overflow Connect Secure Policy Secure Zero Trust Access Gateway

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Pre-authentication stack overflow reachable remotely with no user interaction (AV:N/AC:L/PR:N/UI:N) yields full code execution on the appliance, so C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 05:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 05:22 vuln.today

cvss_changed

CVSS changed

Aug 04, 2026 - 05:22 NVD

9.0 (CRITICAL) 9.8 (CRITICAL)

Analysis Generated

Mar 28, 2026 - 18:34 vuln.today

Added to CISA KEV

Oct 24, 2025 - 14:29 cisa

CISA KEV

PoC Detected

Oct 24, 2025 - 14:29 vuln.today

Public exploit code

CVE Published

Apr 03, 2025 - 16:15 nvd

CRITICAL 9.0

DescriptionNVD

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.

AnalysisAI

Remote code execution in Ivanti Connect Secure (before 22.7R2.6), Ivanti Policy Secure (before 22.7R1.4), and Ivanti ZTA Gateways (before 22.8R2.2) lets a remote unauthenticated attacker overflow a stack buffer to run arbitrary code on the appliance. This flaw is confirmed actively exploited (CISA KEV), with publicly available exploit code and reporting of a suspected China-nexus threat actor, and it carries an elevated EPSS of 53.66% (98th percentile), placing it among the highest-risk internet-facing edge-device vulnerabilities.

Technical ContextAI

Ivanti Connect Secure (formerly Pulse Connect Secure) is an SSL VPN / remote-access gateway, with Policy Secure providing NAC enforcement and the ZTA (Zero Trust Access) Gateways handling zero-trust brokered access; all are internet-facing edge appliances processing untrusted client traffic. The root cause is CWE-121 (Stack-Based Buffer Overflow): attacker-controlled input is copied into a fixed-size stack buffer without adequate bounds checking, allowing corruption of adjacent stack memory (saved return address / control data) and hijack of execution flow. Because these devices terminate remote VPN/HTTPS sessions before authentication, the vulnerable parsing path is reachable pre-auth, and a successful overflow yields native code execution in the appliance context. The CPE data confirms the affected component is the Ivanti Connect Secure application, including the 22.7 R1.x and early R2.x branches.

RemediationAI

Upgrade immediately to the fixed releases per Ivanti's advisory: Vendor-released patch: Connect Secure 22.7R2.6, Policy Secure 22.7R1.4, and ZTA Gateways 22.8R2.2. Because this vulnerability is confirmed actively exploited, treat patching as emergency change and follow it with compromise assessment - review the Integrity Checker Tool (ICT) output and appliance logs for signs of intrusion, and if compromise is suspected, perform a factory reset before restoring to a known-good patched state and rotate all credentials/secrets that transited the device. As a compensating control before patching, restrict management and VPN exposure by limiting internet reachability of the appliance to known IP ranges or placing it behind additional network filtering; note this reduces but does not eliminate risk since the exposed service must remain reachable for legitimate remote users, and it does not remediate an already-compromised device. Refer to Ivanti's advisory (https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457) and the CISA KEV entry (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22457).