Ivanti Connect Secure CVE-2025-22457

No special conditions - remote unauthenticated code execution against Ivanti Connect Secure, Policy Secure, and ZTA Gateway appliances reachable over the network (AV:N/AC:L/PR:N/UI:N), with no user interaction and no credentials required. The primary limiting factor is version: only appliances running versions below the fixes (Connect Secure < 22.7R2.6, Policy Secure < 22.7R1.4, ZTA Gateways < 22.8R2.2) are vulnerable, so patched or newer-branch deployments are not exploitable. Exposure also depends on the appliance's network reachability - a gateway restricted to specific source IP ranges narrows the attacker population, though as an internet-facing VPN it is typically broadly reachable.

All signals align toward maximum priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicates remote, low-complexity, unauthenticated exploitation with full CIA impact and no user interaction. This is corroborated rather than contradicted by the other sources: CISA KEV confirms active exploitation, a public POC exists, and EPSS at 53.66% (98th percentile) reflects broad exploitation likelihood - unusually high and consistent with the KEV listing rather than a targeted-only pattern. Reporting attributes exploitation to a suspected China-nexus actor, typical of edge-VPN targeting for initial access and espionage. There are no conflicting signals here: this is a genuine, top-tier emergency-patch priority, not a high-CVSS-but-low-real-risk case. The primary residual uncertainty is version-boundary precision for Policy Secure and ZTA Gateways, whose fixed versions come from the vendor advisory rather than enumerated CPEs in the provided data.

An attacker scans the internet for exposed Ivanti Connect Secure gateways and sends a crafted request to the pre-authentication request-parsing path, overflowing a stack buffer and overwriting saved control data to redirect execution. With low attack complexity and no authentication or user interaction required, they gain code execution on the appliance and use it as a foothold for lateral movement into the internal network. Public exploit code exists and this technique is already being used in the wild by a suspected China-nexus actor.