Exploited vulnerabilitiesBriefPublic record
Ivanti Connect Secure zero-day (CVE-2025-0282)
Disclosed and patched: 8 Jan 2025. Stack overflow, unauthenticated RCE.
- Disclosed
What happened
- Affected: ICS before 22.7R2.5. Policy Secure and ZTA gateways also affected.
- Exploited: yes. In KEV 8 Jan 2025. China-nexus UNC5221 (Mandiant). Follow-on bug CVE-2025-22457, in KEV 4 Apr 2025.
Live scores
Live scores
CVE-2025-0282- EPSS
- 1.000
very likely to be attacked soon - VEDAS
- 0.983
strong exploit evidence - On CISA KEV
- Yes, since 2025-01-08
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2025-0283- EPSS
- 0.175
likely to be attacked soon - VEDAS
- 0.722
some exploit evidence - On CISA KEV
- Not listed
- Detection rule
- Out of scope (local)
Live scores
CVE-2025-22457- EPSS
- 1.000
very likely to be attacked soon - VEDAS
- 0.981
strong exploit evidence - On CISA KEV
- Yes, since 2025-04-04
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Sources
- https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283
- https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.