Ivanti has disclosed a critical vulnerability, CVE-2025-22457, affecting its Connect Secure, Pulse Connect Secure, Ivanti Policy Secure, and ZTA Gateways products that are actively exploited in the wild. The vulnerability was patched in Ivanti Connect Secure version 22.7R2.6 on February 11, 2025, initially considered a low-risk denial-of-service issue due to its limited character set (periods and numbers). Ivanti confirmed that a limited number of customers running Ivanti Connect Secure (22.7R2.5 or earlier) and Pulse Connect Secure 9.1x appliances were compromised. Ivanti disclosed the vulnerability on April 3, 2025, but Mandiant reports exploitation by UNC5221, a suspected Chinese state-sponsored group, since mid-March. @nekono_naha on April 4, 2025, noted that of 12,471 exposed Ivanti/Pulse Connect Secure servers, 66% (8,246) are vulnerable, with 50% (6,049) on pre-9.x versions, highlighting the urgency of patching. Patch Immediately: Upgrade to Ivanti Connect Secure 22.7R2.6 or migrate from Pulse Connect Secure. “This advisory has been updated to make it clear the vulnerability was fully patched in Ivanti Connect Secure” Ivanti Said. This stack-based buffer overflow flaw, with a CVSS score of 9.0, has been actively exploited since mid-March 2025, posing significant risks to organizations using these VPN and network access solutions. This incident marks Ivanti’s 15th appearance in CISA’s Known Exploited Vulnerabilities catalog since 2024, signaling systemic security challenges with its edge devices. As state-sponsored actors like UNC5221 target such vulnerabilities, organizations must prioritize timely patching and secure deployment. UNC5221, known for targeting edge devices, has previously exploited Ivanti zero-days like CVE-2023-46805.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 04 Apr 2025 20:50:15 +0000