Back to CVE Browser

CVE-2025-0282

🔥 Known Exploited (CISA KEV)CRITICAL

9.0

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2025-01-08

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.

Affected Platforms (CPE)

📦

Ivanti

Connect Secure

= 22.7

📦

Ivanti

Neurons For Zero Trust Access

= 22.7

📦

Ivanti

Policy Secure

= 22.7

References & Advisories

🔗 https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283

🔗 https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day

🔗 https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282

🔗 https://github.com/sfewer-r7/CVE-2025-0282

🔗 https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0282

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-0282

Related Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kuma...

CVE-2026-645247.7

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate resolution_count and fix WIN8 fallback ...

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: avoid kobject path lookup in DualSense match...

CVE-2026-644599.8

In the Linux kernel, the following vulnerability has been resolved: tcp: restore RCU grace period in tcp_ao_destroy_sock Commit ...