CVE-2025-0282

Critical9.0 Published on Jan 8, 2025

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.

Actively exploited

In the CISA exploited-vulnerabilities catalogue since Jan 8, 2025
US federal agencies must remediate it by Jan 15, 2025 (BOD 22-01)
Attacked 1 day before the vulnerability was made public
Confirmed by sensors, not only by reports
Used in ransomware campaigns

Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.

Source: CISA KEV · Jun 22, 2026 Jun 17, 2026 May 28, 2026 Apr 20, 2026 Apr 8, 2026 Mar 18, 2026

CVSS score9.0 / 10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness type (CWE)CWE-121, CWE-787

Vendorsivanti

Affected products

Vendors	Product	Versions
ivanti	connect secure	22.7
ivanti	neurons for zero-trust access	22.7
ivanti	policy secure	22.7

Vulnerabilities

BeyondTrust Remote Support Zero-Day Exploited Against Hosted and Self-Hosted Appliances

BeyondTrust Remote Support zero-day exploited in hosted and self-hosted appliances, enabling file operations and root access, linked to Armory Castle.

Oct 16, 202614:40 4 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database