Ongoing Campaign Targeting Ivanti Products

A critical vulnerability, identified as CVE-2025-22457, has been reported in Ivanti Connect Secure, Pulse Connect Secure, Ivanti Policy Secure, and ZTA Gateways. The vulnerability has a Common Vulnerability Scoring System (CVSSv3.1) score of 9.0 out of 10, and is reportedly being actively exploited.

Successful exploitation of the stack-based buffer overflow vulnerability could allow an unauthenticated attacker to perform remote code execution.

Affected Product Versions:

• Ivanti Connect Secure: 22.7R2.5 and prior

• Pulse Connect Secure: 9.1R18.9 and prior

• Ivanti Policy Secure: 22.7R1.3 and prior

• ZTA Gateways: 22.8R2 and prior

Users and administrators of affected Ivanti Connect Secure versions are advised to update to the latest version immediately.

For the other products, Ivanti has recommended the following:

• Pulse Connect Secure 9.1x: Contact Ivanti to migrate. This solution reached End-of-Support on December 31, 2024, and no longer receives any code changes. Ivanti cannot provide guidance to customers who stay on an unsupported version. Users and administrators of affected versions should migrate to a secure platform to ensure their security.

• Ivanti Policy Secure: A patch is in development and will be available on April 21, 2025. As the product is not internet facing, the risk to this product is greatly reduced. Ivanti is not aware of the vulnerability being exploited in Ivanti Policy Secure.

• Ivanti ZTA Gateways: A patch is in development and will be automatically applied to environments on April 19, 2025. The Ivanti Neurons ZTA gateways cannot be exploited when in production. If a gateway for this solution is generated and left unconnected to a ZTA controller, then there is a risk of exploitation on the generated gateway. Ivanti is not aware of the vulnerability being exploited in ZTA gateway.

To aid in identifying compromised system(s), we recommend monitoring your Integrity Checker Tool (ICT), as well as checking for these indicators of compromise (IOCs), as provided by Mandiant:

More information is available here:

https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457?language=en_US

https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-exploiting-critical-ivanti-vulnerability