Article
Five edge VPN flaws CISA flags for ransomware use
Five VPN and firewall flaws added to CISA KEV in 2025 and 2026 carry a ransomware flag. Dates, fixed versions and what to check…
Read more
Exploited vulnerability
Ivanti Connect Secure buffer overflow (CVE-2025-22457)
CVE-2025-22457
CVE-2025-22457 is a stack-based buffer overflow in Ivanti Connect Secure, Policy Secure and ZTA Gateways.
- On CISA KEV
- CVE ID
- CVE-2025-22457
- CISA KEV
- Listed
- Affected product
- Ivanti Connect Secure (formerly Pulse Connect Secure), Policy Secure and ZTA Gateways
- Exploited
- Yes
- Published
- April 2025
In short
CVE-2025-22457 is a stack-based buffer overflow in Ivanti Connect Secure, Policy Secure and ZTA Gateways. A buffer overflow means a program writes more data than a reserved space can hold, which can let an attacker run their own code. CISA lists it as exploited and flags known ransomware campaign use.
- CVECVE-2025-22457
- ProductIvanti Ivanti Connect Secure (formerly Pulse Connect Secure), Policy Secure and ZTA Gateways
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedUpgrade Connect Secure · Detect and hunt
What it allows
A remote attacker with no account can run code on the appliance. Connect Secure is a VPN gateway that sits on the edge of the network, so a takeover can give a foothold inside it. NVD scores it 9.8 (CVSS v3.1). Ivanti scores it 9.0 (CVSS v3.0) and calls it critical.
Who is affected
Per Ivanti: Connect Secure 22.7R2.5 and earlier (fixed in 22.7R2.6), Pulse Connect Secure 9.1R18.9 and earlier (end of support since 31 December 2024, no fix, migrate), Policy Secure 22.7R1.4 and earlier (fixed in 22.7R1.5) and ZTA Gateways 22.8R2 and earlier (fixed in 22.8R2.2). At disclosure Ivanti knew of exploitation only on Connect Secure and Pulse Connect Secure 9.1x, not on Policy Secure or ZTA Gateways.
Ivanti says the flaw was fixed in Connect Secure 22.7R2.6, released on 11 February 2025, and was first treated as a product bug. Its first judgment was that it could not be used for code execution. Ivanti later learned it could be exploited "through sophisticated means" and published its advisory on 3 April 2025, saying a limited number of customers had already been exploited. Ivanti's advisory does not give the date of the first attack.
CISA added CVE-2025-22457 to its Known Exploited Vulnerabilities (KEV) catalog on 4 April 2025, with a due date of 11 April 2025. The KEV entry flags known use in ransomware campaigns. CISA's mitigation page tells owners to run Ivanti's integrity checker, hunt on systems connected to the device and, for the highest confidence, factory reset the appliance.
The official sources opened for this page (Ivanti, NVD, CISA) do not name who exploited the flaw, so this page does not attribute it to any group.
What to do
-
Upgrade Connect Secure
Install 22.7R2.6 or later. Ivanti says it fully fixed the vulnerable code. Policy Secure needs 22.7R1.5 and ZTA Gateways 22.8R2.2.
-
Replace end-of-support Pulse Connect Secure
Pulse Connect Secure 9.1x gets no code changes. Ivanti says the only option is to migrate to a supported platform.
-
Run the integrity checker and reset if needed
Run Ivanti's external Integrity Checker Tool. If it shows compromise, isolate the device, take a forensic image, factory reset it and reload 22.7R2.6, as Ivanti and CISA advise.
-
Reset secrets after a compromise
CISA says to revoke and reissue certificates, keys and passwords stored on or reachable from the device. This includes the admin enable password, stored API keys, local gateway users and service accounts. For domain accounts, reset passwords twice and revoke Kerberos tickets.
-
Detect and hunt
Ivanti says to monitor the external integrity check result and look for web server crashes. CISA also asks owners to hunt on systems that are connected, or were recently connected, to the device.
Questions
What is CVE-2025-22457?
It is a stack-based buffer overflow in Ivanti Connect Secure, Policy Secure and ZTA Gateways. A remote attacker with no account can run code on the appliance. Connect Secure is a VPN gateway on the network edge, so a takeover can give a foothold inside.
Which Ivanti versions fix CVE-2025-22457?
Connect Secure 22.7R2.6, Policy Secure 22.7R1.5 and ZTA Gateways 22.8R2.2. Pulse Connect Secure 9.1x reached end of support on 31 December 2024 and gets no fix, so Ivanti says the only option is to migrate to a supported platform.
What should I do if my Ivanti Connect Secure appliance may be compromised?
Run Ivanti's external Integrity Checker Tool. If it shows compromise, isolate the device, take a forensic image, factory reset it and reload 22.7R2.6, as Ivanti and CISA advise. CISA also says to revoke and reissue stored certificates, keys and passwords.
In our research
- Five edge VPN flaws CISA flags for ransomware use October 2026
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.