PT-2025-6242 · Ivanti · Ivanti Connect Secure

Published 2025-02-11 · Updated 2026-05-04 · CVE-2025-22467

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions prior to 22.7R2.6

Description A stack-based buffer overflow in Ivanti Connect Secure allows a remote authenticated attacker to achieve remote code execution. The issue is actively exploited. Approximately 3.2 million services are found to be vulnerable, with the top affected countries being the US and Japan. Around 2850 IP addresses are seen unpatched worldwide.

Recommendations To resolve the issue, download and install Ivanti Connect Secure version 22.7R2.6 or later. As a temporary workaround, consider restricting access to the vulnerable component until a patch is applied.

Fix

RCE

Stack Overflow

Out of bounds Read

Weakness Enumeration

CWE-121

CWE-125

Related Identifiers

BDU:2025-01566

CVE-2025-22467

Affected Products

Ivanti Connect Secure

References · 49

• https://nvd.nist.gov/vuln/detail/CVE-2025-22467 · Security Note
• https://forums.ivanti.com/s/article/February-Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-and-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01566 · Security Note
• https://osv.dev/vulnerability/CVE-2025-22467 · Vendor Advisory
• https://t.me/true_secator/6726 · Telegram Post
• https://twitter.com/JohnGerhar76023/status/1890830591639069039 · Twitter Post
• https://twitter.com/transilienceai/status/1891460652796952650 · Twitter Post
• https://t.me/CSIRT_italia/3024 · Telegram Post
• https://twitter.com/syedaquib77/status/1894758293471699056 · Twitter Post
• https://twitter.com/Netlas_io/status/1889598303324565718 · Twitter Post
• https://forums.ivanti.com/s/article/February-Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-and-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs?language=en_US · Note
• https://t.me/pentestingnews/56458 · Telegram Post
• https://twitter.com/rfwaveio/status/1889854252161573112 · Twitter Post
• https://twitter.com/HunterMapping/status/1890219110044143736 · Twitter Post
• https://twitter.com/Shadowserver/status/1894482559347593316 · Twitter Post