{"id":"CVE-2025-22457","kind":"vulnerability","aliases":["CVE-2025-22457"],"related":[],"title":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version…","description":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.\n\nCISA required action: Apply mitigations as set forth in the CISA instructions linked below.","summary":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow that lets a remote unauthenticated attacker run code. CISA lists it as exploited in the wild and tied to ransomware campaigns.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2025-04-04T00:00:00+00:00","products":[{"name":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"ivanti connect secure","fixed":["22.7"],"affected":"< 22.7","ecosystem":"vendor"},{"name":"ivanti connect secure","fixed":[],"affected":"= 22.7","ecosystem":"vendor"},{"name":"ivanti policy secure","fixed":["22.7"],"affected":"< 22.7","ecosystem":"vendor"},{"name":"ivanti policy secure","fixed":[],"affected":"= 22.7","ecosystem":"vendor"},{"name":"ivanti zero trust access gateway","fixed":["22.8"],"affected":"< 22.8","ecosystem":"vendor"},{"name":"ivanti zero trust access gateway","fixed":[],"affected":"= 22.8","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["connect-secure","exploited","infrastructure","ivanti","ransomware","self-hosted","vpn-gateway"],"not_affected_if":["not-using-ivanti-gateway"],"how_to_check":null,"fix":"Apply the mitigations and patches from Ivanti and the CISA instructions linked in the KEV entry; exact fixed versions are unknown from these sources.","status":"open","published_at":"2025-04-03T16:15:35+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:48:51+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T20:48:51Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations and patches from Ivanti and the CISA instructions linked in the KEV entry; exact fixed versions are unknown from these sources.","reach":"internet","summary":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow that lets a remote unauthenticated attacker run code. CISA lists it as exploited in the wild and tied to ransomware campaigns.","category":"infrastructure","who_cares":["ivanti","connect-secure","vpn-gateway","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the VPN gateway without logging in.","analyst_note":"Find affected and fixed versions and the vendor advisory at Ivanti's security site, plus the CISA mitigation instructions linked from the KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-using-ivanti-gateway"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000453,"input_tokens":2585,"output_tokens":388,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':21A,24A '-22457':22A,25A '22.7':13A 'access':49A,54A 'achiev':128C 'action':134C 'allow':122C 'and':31A 'appli':135C 'attack':89B,126C 'base':4A,81B,117C 'buffer':5A,82B,118C 'campaign':104B 'cisa':92B,132C,142C 'code':91B,130C 'connect':9A,27A,35A,38A,57B,70B,106C 'connect-secur':56B 'contain':77B,113C 'cve':20A,23A 'execut':131C 'exploit':59B,96B 'forth':139C 'gateway':50A,55A,68B,76B,112C 'gateways':33A 'host':65B 'infrastructur':60B 'instruct':143C 'ivanti':8A,15A,26A,34A,37A,40A,43A,46A,51A,61B,69B,105C 'let':85B 'link':144C 'list':93B 'mitig':136C 'overflow':6A,83B,119C 'polici':16A,72B,108C 'policy':29A,41A,44A 'r2.6':14A 'ransomwar':62B,103B 'remot':87B,124C,129C 'requir':133C 'run':90B 'secur':10A,17A,58B,71B,73B,107C,109C 'secure':28A,30A,36A,39A,42A,45A 'self':64B 'self-host':63B 'set':138C 'stack':3A,80B,116C 'stack-bas':2A,79B,115C 'tie':101B 'trust':48A,53A 'unauthent':88B,125C 'version':12A,19A 'vpn':67B 'vpn-gateway':66B 'vulner':120C 'wild':99B 'zero':47A,52A 'zta':32A,75B,111C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-04-03T16:15:35+00:00","kev":{"dateAdded":"2025-04-04","dueDate":"2025-04-11","requiredAction":"Apply mitigations as set forth in the CISA instructions linked below.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-22457","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-22457","severity":null,"published_at":"2025-04-04T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T13:39:29+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-22457","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22457","severity":null,"published_at":"2025-04-03T16:15:35+00:00","modified_at":"2026-08-04T05:16:33+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}