CVE-2025-0282

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.

Affected

Ivanti · Connect Secure · Policy Secure · Neurons for ZTA gateways

CVSS v3.1 NVD

9.0 CRITICALCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

99.98% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2025-01-08, used in ransomware campaigns

Nuclei

critical

Published

2025-01-08

Updated

2026-10-01

Proof-of-concept exploits (11)

• https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-…
• AdaniKamal/CVE-2025-02822★ · 2025-01-28
• AnonStorks/CVE-2025-0282-Full-version4★ · 2025-01-12
• Hexastrike/Ivanti-Connect-Secure-Logs-Parser6★ · 2025-01-19
• Hexastrike/Ivanti-Secure-Connect-Logs-Parser6★ · 2025-01-19
• absholi7ly/CVE-2025-0282-Ivanti-exploit53★ · 2025-01-11
• almanatra/CVE-2025-02822★ · 2025-01-22
• watchtowrlabs/CVE-2025-028231★ · 2025-01-18
• gmh5225/Blackash-CVE-2025-02820★ · 2025-06-07
• razureink/cve-2025-0282-ivanti_rce_reproduction0★ · 2026-07-24
• sfewer-r7/CVE-2025-028249★ · 2025-01-16

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0282.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52213

Security advisories

• https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure…
• https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-…
• https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282

References

• CVE Record
• NVD entry

Related

• CVE-2024-3400
• CVE-2008-4654
• CVE-2023-20048
• CVE-2023-50029
• CVE-2024-21683
• CVE-2024-30056