CVE-2025-22457

Description

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.

Reserved 2025-01-07 | Published 2025-04-03 | Updated 2025-04-24 | Assigner ivanti

CISA Known Exploited Vulnerability

Date added 2025-04-04 | Due date 2025-04-11

Known Ransomware Campaign(s)

Apply mitigations as set forth in the CISA instructions linked below.

Problem types

CWE-121 Stack-based Buffer Overflow

Product status

Default status
affected

22.7R2.6
unaffected

Default status
affected

22.7R1.4
unaffected

Default status
affected

22.8R2.2
unaffected

References

forums.ivanti.com/...licy-Secure-ZTA-Gateways-CVE-2025-22457

cve.org (CVE-2025-22457)

nvd.nist.gov (CVE-2025-22457)

Download JSON