Fixed Intel

CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation Deadline: Apr 11, 2025

CVE-2025-22457

High
EPSS 53.7%CISA KEVRansomware
Ivanti/Connect Secure, Policy Secure, and ZTA Gateways

Description

Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.

EPSS — Exploit Probability

53.7%

Higher than 98.0% of all CVEs

Required Action

CISA Mitigation Instructions: https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-22457 ; Additional References: https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457 ; https://nvd.nist.gov/vuln/detail/CVE-2025-22457

Risk Assessment

CRITICAL
In CISA KEV
High EPSS
Ransomware

Details

Severity
High
EPSS
53.7%
CISA KEV
Yes
Ransomware
Known
Articles
0

Timeline

Published

Apr 4, 2025

Added to KEV

Apr 4, 2025

Remediation Due

Apr 11, 2025

Affected Product

Ivanti

Connect Secure, Policy Secure, and ZTA Gateways

View all Ivanti CVEs