Home / Vulnerabilities / CVE-2025-22457
CRITICAL SEVERITY Ransomware Linked
CVE-2025-22457 Ivanti · Connect Secure, Policy Secure, and ZTA Gateways

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Critical Threat Advisory: This vulnerability is documented in active Ransomware campaigns. Immediate remediation required.

Technical Severity

CVSS v3.1 Metrics

CRITICAL
9 / 10
Minimal Risk Critical
Vector Specification
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploitation Likelihood

EPSS Prediction

55.52 %
Predictive Probability
Percentile Rank
98.0 th

Documented as more likely to be exploited than 98.0% of known CVEs.

Detection Date

Apr 04, 2025

Remediation Due

Apr 11, 2025

CISA Catalog Active

Threat Analysis

Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.

Remediation Directive

Apply mitigations as set forth in the CISA instructions linked below.

External Intelligence

CISA

CISA Advisory

https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-22457

Additional References:

https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457
NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2025-22457