CVE-2025-22457

VendorivantiProductconnect secure, policy secure, zero trust access gatewayDiscoveredApr 3, 2025UpdatedAug 4, 2026

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.

View graph Watch Export

CVSS v3.1

9 CRITICAL

EPSS

99.9%

probability of exploitation in 30 days

CISA KEV

Listed

confirmed active exploitation

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Aug 16, 2026 → Sep 11, 2026

● 0.01pp

99.9% → 99.9% over 3 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityHIGH

Privileges RequiredNONE

User InteractionNONE

ScopeCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityHIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Connections

6 relationships

CWE-121

source

Timeline

disclosure → media coverage

Apr 3, 2025

Disclosure — published as a CVE record. · last revised by NVD Aug 4, 2026

Nov 2, 2026

bleepingcomputer.com reports: Ivanti patches two more Connect Secure zero-days chained in attacks

Public PoC (6)

github.com/Vinylrider/ivantiunlocker github.com/sfewer-r7/CVE-2025-22457 github.com/securekomodo/CVE-2025-22457 github.com/TRone-ux/CVE-2025-22457 github.com/benmevic/cve-2025-22457 github.com/donofly/CVE-2025-22457-vulnserver-lab

Unverified third-party code — review before executing.