ACTIVELY EXPLOITED
CVE-2025-0282: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
| Vendor | Ivanti |
|---|---|
| Product | Connect Secure, Policy Secure, and ZTA Gateways |
| Actively exploited | Yes |
| Added to CISA KEV | 8 Jan 2025 |
| CISA federal deadline | 15 Jan 2025 |
| Ransomware use | Known |
| Weakness (CWE) | CWE-121 |
Required action (CISA's text)
Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.
Description (NVD)
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.
SOURCES
Other Ivanti flaws
- CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
- CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
- CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
- CVE-2026-10520: Ivanti Sentry OS Command Injection Vulnerability
- CVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.