{"id":"CVE-2025-22457","aliases":["EUVD-2025-9646","GHSA-jjr5-fpcg-gc53"],"status":"published","title":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy...","description":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.","severity":{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.99981,"percentile":0.99981,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-121","CWE-787"],"published":"2025-04-03T15:20:23Z","modified":"2026-08-04T05:16:33Z","kev":{"date_added":"2025-04-04","due_date":"2025-04-11","required_action":"Apply mitigations as set forth in the CISA instructions linked below.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2025-04-04"},{"source":"kev","since":"2025-04-04"}],"exploits":[{"source":"metasploit","id":"exploit/linux/http/ivanti_connect_secure_stack_overflow_rce_cve_2025_22457","title":"Ivanti Connect Secure Unauthenticated Remote Code Execution via Stack-based Buffer Overflow","type":"exploit","platform":"Linux,Unix","date":"2025-04-03","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/ivanti_connect_secure_stack_overflow_rce_cve_2025_22457"},{"source":"pocgithub","id":"Vinylrider/ivantiunlocker","title":"Vinylrider/ivantiunlocker","date":"2025-04-08","url":"https://github.com/Vinylrider/ivantiunlocker"},{"source":"pocgithub","id":"sfewer-r7/CVE-2025-22457","title":"sfewer-r7/CVE-2025-22457","date":"2025-04-09","url":"https://github.com/sfewer-r7/CVE-2025-22457"},{"source":"pocgithub","id":"securekomodo/CVE-2025-22457","title":"securekomodo/CVE-2025-22457","date":"2025-04-10","url":"https://github.com/securekomodo/CVE-2025-22457"},{"source":"pocgithub","id":"TRone-ux/CVE-2025-22457","title":"TRone-ux/CVE-2025-22457","date":"2025-05-25","url":"https://github.com/TRone-ux/CVE-2025-22457"},{"source":"pocgithub","id":"benmevic/cve-2025-22457","title":"benmevic/cve-2025-22457","date":"2026-07-09","url":"https://github.com/benmevic/cve-2025-22457"},{"source":"pocgithub","id":"donofly/CVE-2025-22457-vulnserver-lab","title":"donofly/CVE-2025-22457-vulnserver-lab","date":"2026-09-23","url":"https://github.com/donofly/CVE-2025-22457-vulnserver-lab"}],"products":[{"vendor":"ivanti","product":"connect secure"},{"vendor":"ivanti","product":"connect secure, policy secure, and zta gateways"},{"vendor":"ivanti","product":"connect_secure"},{"vendor":"ivanti","product":"neurons for zta gateways"},{"vendor":"ivanti","product":"policy secure"},{"vendor":"ivanti","product":"policy_secure"},{"vendor":"ivanti","product":"zero_trust_access_gateway"}],"references":[{"url":"https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22457","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22457"},{"url":"https://github.com/advisories/GHSA-jjr5-fpcg-gc53"}],"sources":{"cve":[{"id":"CVE-2025-22457","description":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.","status":"published","published":"2025-04-03T15:20:23.628Z","modified":"2026-08-04T03:55:47.416Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:32:29.286772Z"}],"euvd":[{"id":"EUVD-2025-9646","description":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.","status":"published","published":"2025-04-03T15:20:23Z","modified":"2026-08-04T03:55:47Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2025-04-04","updated_at":"2026-11-02T18:02:23.332335Z"}],"ghsa":[{"id":"GHSA-jjr5-fpcg-gc53","title":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy...","description":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.","status":"published","published":"2025-04-03T18:30:58Z","modified":"2025-10-22T00:34:21Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T15:04:09.266545Z"}],"kev":[{"id":"CVE-2025-22457","title":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability","description":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution. ","cwes":["CWE-121"],"kev":{"date_added":"2025-04-04","due_date":"2025-04-11","required_action":"Apply mitigations as set forth in the CISA instructions linked below.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2025-22457","description":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.","status":"published","published":"2025-04-03T16:15:35.37Z","modified":"2026-08-04T05:16:33.707Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T14:10:58.094557Z"}]}}