CVE-2025-0283Disclosure(ivanti / connect_secure)

MEDIUMCVSS 7.0 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch ivanti connect_secure systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a local authenticated attacker to escalate their privileges.

4.0/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-121CWE-787

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • connect_secure
  • neurons_for_zero-trust_access
  • policy_secure

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-03-01); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
Products
connect_secureneurons_for_zero-trust_accesspolicy_secure

11 versions affected across 3 products

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-03-01: 1Mentions · 2026-04-14: 1Active Exploitation · 2026-04-14: 1Patch / Workaround · 2026-03-01: 1Technical Details · 2026-03-01: 1Technical Details · 2026-04-14: 103-0104-14
Signal classification2 categories
Disclosure
150.0%
Active Exploitation
150.0%
Referenced assets2 URLs
By indicator
Classification over time
DateTotalLabels
2026-03-011
Disclosure1
2026-04-141
Active Exploitation1
Full discourse2 posts
  • TermsofSurrender 🇨🇿 🇮🇱@Aftershockindex
    Disclosure

    🚨 Ivanti Decides Security Is Purely Optional While Prague Bureaucrats Wait For A Signed Permission Slip Two fresh zero-day vulnerabilities, CVE-2025-0282 and CVE-2025-0283, allow for unauthenticated remote code execution and full system compromise across Ivanti's entire 'secure' product line. GrayZone is already screaming about this digital arson while the local Czech media is busy taking a three-hour lunch break to discuss the rising cost of pickled hermelín. These Ivanti boxes are basically open invitations for any state-sponsored actor with half a brain, yet the 'experts' in this city won't notice the breach until their fax machines start printing Mandarin. It is pathetic watching these bloated corporations pretend their 'Zero Trust' architecture isn't just a fancy way of saying 'we have no idea who is in our basement.' While the global intelligence community is on fire, the local response team is likely still trying to find the keys to the server room that were lost sometime during the late nineties. If you are still running this hardware, you do not need a patch; you need a priest and a very large bucket of water for the impending hardware fire. PANIC: 89/100 | TRUST: 75% | ZONE: GrayZone https://hodl.cz/as-107744 #CyberSecurity #AfterShockIndex #CyberThreat #Cybersecurity #Czechia

    Post summary

    The post announces two zero‑day CVEs (CVE‑2025‑0282/0283) that enable unauthenticated remote code execution on Ivanti products, notes that no patch is required, and does not provide PoC or exploit details.

    00001158
    2 followersView on X
  • CTIWatch@ctiwatchcloud
    Active Exploitation

    🚨 [HIGH] Active exploitation detected: CVE-2025-0283 Exploit in the wild confirmed for CVE-2025-0283 (CVSS null). A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Po... 🔗 http://ctiwatch.cloud/alerts #ZeroDay #ExploitInWild #CyberSecurity

    Post summary

    CVE‑2025‑0283 is a stack-based buffer overflow in Ivanti Connect Secure (pre‑22.7R2.5) that is confirmed to be actively exploited in the wild, with no patch or PoC described in the alert.

    00000257
    5.6K followersView on X
CPE platform detail82 entries

82 of 82 entries

PartVendorProductVersionTarget SWTarget HW
Appivanticonnect_secure---
Appivanticonnect_secure21.12--
Appivanticonnect_secure21.9--
Appivanticonnect_secure22.1--
Appivanticonnect_secure22.1--
Appivanticonnect_secure22.7--
Appivanticonnect_secure22.7--
Appivanticonnect_secure22.7--
Appivanticonnect_secure22.7--
Appivanticonnect_secure22.7--
Appivanticonnect_secure22.7--
Appivanticonnect_secure22.7--
Appivanticonnect_secure22.7--
Appivanticonnect_secure22.7--
Appivanticonnect_secure22.7--
Appivanticonnect_secure22.7--
Appivanticonnect_secure22.7--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivanticonnect_secure9.1--
Appivantineurons_for_zero-trust_access---
Appivantineurons_for_zero-trust_access22.2--
Appivantineurons_for_zero-trust_access22.2--
Appivantineurons_for_zero-trust_access22.2--
Appivantineurons_for_zero-trust_access22.3--
Appivantineurons_for_zero-trust_access22.3--
Appivantineurons_for_zero-trust_access22.4--
Appivantineurons_for_zero-trust_access22.4--
Appivantineurons_for_zero-trust_access22.5--
Appivantineurons_for_zero-trust_access22.5--
Appivantineurons_for_zero-trust_access22.6--
Appivantineurons_for_zero-trust_access22.6--
Appivantineurons_for_zero-trust_access22.6--
Appivantineurons_for_zero-trust_access22.6--
Appivantineurons_for_zero-trust_access22.6--
Appivantineurons_for_zero-trust_access22.6--
Appivantineurons_for_zero-trust_access22.7--
Appivantineurons_for_zero-trust_access22.7--
Appivantineurons_for_zero-trust_access22.7--
Appivantineurons_for_zero-trust_access22.7--
Appivantineurons_for_zero-trust_access22.7--
Appivantineurons_for_zero-trust_access22.7--
Appivantineurons_for_zero-trust_access22.7--
Appivantineurons_for_zero-trust_access22.7--
Appivantineurons_for_zero-trust_access22.7--
Appivantipolicy_secure---
Appivantipolicy_secure22.7--
Appivantipolicy_secure22.7--
Appivantipolicy_secure22.7--
Appivantipolicy_secure22.7--

Explore more