Embattled IT software vendor Ivanti on Wednesday raised an alarm for a pair of remotely exploitable vulnerabilities in its enterprise-facing products and warned that one of the bugs has already been exploited in the wild.
The high-severity vulnerabilities, tagged as CVE-2025-0282 and CVE-2025-0283, allow unauthenticated remote attackers to launch code execution and privilege escalation attacks.
“We are aware of a limited number of customers’ Ivanti Connect Secure appliances being exploited by CVE-2025-0282 at the time of disclosure. We are not aware of these CVEs being exploited in Ivanti Policy Secure or ZTA gateways,” Ivanti said in an advisory.
The company did not share IOCs (indicators of compromise) or other telemetry data to help defenders hunt for signs of compromise.
From the Ivanti bulletin:
CVE-2025-0282: Rated critical with a CVSS score of 9.0, this vulnerability is described as a stack-based buffer overflow that allows unauthenticated remote attackers to execute arbitrary code. Exploited versions include Ivanti Connect Secure prior to version 22.7R2.5, Ivanti Policy Secure prior to 22.7R1.2, and Ivanti Neurons for ZTA Gateways prior to 22.7R2.3.
CVE-2025-0283: Rated high with a CVSS score of 7.0, this vulnerability enables local authenticated attackers to escalate privileges through a stack-based buffer overflow. The flaw impacts the same product versions as CVE-2025-0282.
“We are not aware of any exploitation of CVE-2025-0283 at the time of disclosure,” Ivanti added.
Ivanti said exploitation of CVE-2025-0282 can be identified by its Integrity Checker Tool (ICT) and urged customers to closely monitor internal and external ICT to ensure the integrity and security of the entire network infrastructure.
The company recommends that customers immediately upgrade to Ivanti Connect Secure 22.7R2.5 and continue to closely monitor internal and external ICT in conjunction with other security tools.
A factory reset on appliances with a clean ICT scan is recommended before putting 22.7R2.5 in production out of an abundance of caution, the company said.
Notably, the company said the Ivanti Policy Secure product is not intended to be internet-facing, which makes the risk of exploitation significantly lower. A fix for Ivanti Policy Secure is planned for release on January 21, 2025.
Related: Ivanti CEO Vows Cybersecurity Makeover After Zero-Day Blitz
Related: Ivanti Patches Critical Flaws in Connect Secure, Cloud Services Application
Related: Chinese State Hackers Main Suspect in Recent Ivanti CSA Zero-Day Attacks
Related: Ivanti Warns Customers of More CSA Zero-Days Exploited in Attacks
