2025-016: Critical Vulnerability in Ivanti Products

2025-016: Critical Vulnerability in Ivanti Products ↗ source

April 3, 2025 CERT-EU Advisory

Source: https://cert.europa.eu/publications/security-advisories/2025-016/

Summary

The vulnerability has been fixed in the February 2025 release and was initially identified as a product bug. CERT-EU recommends upgrading to a supported and fixed version of Ivanti products as soon as possible. CERT-EU also recommends reviewing forensic evidence to detect any signs of exploitation. The vulnerability CVE-2025-22457, with a CVSS score of 9.0, is a stack-based buffer overflow vulnerability. When exploited, it allows for unauthenticated remote code execution on affected The vulnerability affects the following products and versions: CERT-EU recommends upgrading to a supported and fixed version of Ivanti products as soon as possible.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2025-22457	9.0 Critical	Ivanti Connect Secure, Policy Secure, and ZTA Gateways Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated atta…

Extracted from the publication text. Each CVE links to its tracked detail page.

Vendors Named in This Publication

Ivanti 35 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.