Vulnerability Description
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ivanti | Connect Secure | < 22.7 |
| Ivanti | Policy Secure | < 22.7 |
| Ivanti | Zero Trust Access Gateway | < 22.8 |
Related Weaknesses (CWE)
References
- https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-SecurVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-US Government Resource
FAQ
What is CVE-2025-22457?
CVE-2025-22457 is a vulnerability with a CVSS score of 9.0 (CRITICAL). A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenti...
How severe is CVE-2025-22457?
CVE-2025-22457 has been rated CRITICAL with a CVSS base score of 9.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-22457?
Check the references section above for vendor advisories and patch information. Affected products include: Ivanti Connect Secure, Ivanti Policy Secure, Ivanti Zero Trust Access Gateway.