ACTIEF MISBRUIKT
CVE-2025-0282: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
| Leverancier | Ivanti |
|---|---|
| Product | Connect Secure, Policy Secure, and ZTA Gateways |
| Actief misbruikt | Ja |
| Toegevoegd aan CISA KEV | 8 jan 2025 |
| CISA-deadline (Amerikaanse overheid) | 15 jan 2025 |
| Gebruik door ransomware | Bekend |
| Zwakte (CWE) | CWE-121 |
Vereiste actie (tekst van CISA, Engels)
Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.
Beschrijving (NVD, Engels)
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.
BRONNEN
Andere lekken bij Ivanti
- CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
- CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
- CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
- CVE-2026-10520: Ivanti Sentry OS Command Injection Vulnerability
- CVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
Gegevens van NVD, CISA KEV, FIRST EPSS en adviezen van leveranciers. Bijgewerkt 10 nov 2026.