Loading story…
Ivanti disclosed security updates for Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways to address CVE-2025-0282 and CVE-2025-0283. The most serious flaw, CVE-2025-0282, is a critical stack-based buffer overflow with a CVSS score of 9.0 that enables unauthenticated remote code execution and has been actively exploited against Ivanti Connect Secure appliances. The second issue, CVE-2025-0283, is a high-severity flaw with a CVSS score of 7.0 that can allow a local authenticated attacker to escalate privileges.
According to CSIRT.SK, citing JPCERT/CC, attackers have used CVE-2025-0282 to deploy the SPAWNCHIMERA malware framework, which combines SPAWNANT, SPAWNMOLE, and SPAWNNAIL and includes functionality intended to prevent reinfection by competing threat actors. Ivanti urged customers to urgently patch affected systems, verify appliance integrity with the Integrity Checker Tool, and consider performing a factory reset before patching if compromise is suspected.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Ivanti advised customers to verify device integrity with the Integrity Checker Tool and to consider a factory reset before applying patches. The company also urged customers to update affected systems as a matter of urgency.
JPCERT/CC reported that attackers were using CVE-2025-0282 to deploy the SPAWNCHIMERA malware framework. The framework was described as combining SPAWNANT, SPAWNMOLE, and SPAWNNAIL and including a mechanism to block reinfection by other actors.
Ivanti and CSIRT.SK reported that CVE-2025-0282 was being actively exploited against Ivanti Connect Secure devices to install malware. The exploitation activity elevated the issue from a disclosed vulnerability to an in-the-wild threat.
Ivanti released security updates for Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways to address CVE-2025-0282 and CVE-2025-0283. The advisory described CVE-2025-0282 as a critical unauthenticated remote code execution flaw and CVE-2025-0283 as a high-severity local privilege escalation issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
forums.ivanti.com
Open sourcecsirt.sk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A suspected China-linked espionage actor has been actively exploiting **CVE-2025-22457**, a critical stack-based/buffer overflow flaw in **Ivanti Connect Secure** that enables unauthenticated remote code execution and full device compromise. Ivanti and Mandiant said exploitation began in mid-March against vulnerable **Ivanti Connect Secure** appliances, with attacks also affecting **Pulse Connect Secure** and prompting security updates for **Ivanti Policy Secure** and **ZTA Gateways**. The flaw carries a **CVSS 9.0** rating and affects Ivanti Connect Secure `22.7R2.5` and earlier, while the corrected version was shipped in `22.7R2.6`. Mandiant attributed the activity and deployment of the **SPAWN** malware ecosystem to **UNC5221**, a suspected China-nexus threat actor known for targeting edge devices with zero-days. Post-compromise activity included a shell-script dropper that installs two newly identified malware families, **TRAILBLAZE** and **BRUSHFIRE**, while operators also attempted to evade detection by tampering with Ivanti's Integrity Checker Tool and routing activity through compromised **Cyberoam**, **QNAP**, and **ASUS** devices. Ivanti and defenders urged organizations to immediately upgrade supported systems, migrate away from end-of-support **Pulse Connect Secure**, and monitor for indicators such as web-process core dumps, Integrity Checker Tool state dumps, and anomalous client TLS certificates.
Jul 24, 2026
Ivanti disclosed multiple critical vulnerabilities affecting **Ivanti Connect Secure**, **Ivanti Policy Secure**, and **Ivanti Neurons for ZTA Gateway**, including `CVE-2025-0282` (CVSS 9.0), a stack-based buffer overflow that allows unauthenticated remote code execution, and `CVE-2025-0283` (CVSS 7.0), which enables privilege escalation. Ivanti said `CVE-2025-0282` has been exploited in the wild against Ivanti Connect Secure, prompting urgent guidance for organizations to upgrade to fixed releases and use the **Integrity Checker Tool** to look for signs of compromise. Authorities later warned that `CVE-2025-22457` is also being actively exploited in **Ivanti Connect Secure** and **Pulse Connect Secure**, allowing remote command execution on vulnerable systems. Ivanti Connect Secure addressed that flaw in version **22.7R2.6**, but **Pulse Connect Secure 9.x** has no patch and will not receive one, leaving migration and retirement as the only mitigation for legacy deployments. While Ivanti Policy Secure and ZTA Gateway are also affected by `CVE-2025-22457`, exploitation had not been observed in those products at the time of reporting.
Jun 29, 2026
Ivanti released security updates for **Ivanti Connect Secure**, **Policy Secure**, **ZTA Gateway**, and **Neurons for Secure Access** to fix four vulnerabilities, including two high-severity remote unauthenticated denial-of-service flaws tracked as `CVE-2025-5456` and `CVE-2025-5462`. The bugs stem from memory-safety weaknesses including a buffer over-read and a heap-based buffer overflow that can be triggered through crafted network input, potentially crashing appliances that provide VPN, zero-trust, and access-control services. Ivanti said cloud instances of Neurons for Secure Access were remediated by **August 2, 2025**, while on-premises customers must apply the fixed releases. The same advisory also addressed `CVE-2025-5466`, an authenticated administrator **XXE** issue that can cause denial of service, and `CVE-2025-5468`, a symbolic link handling flaw that could let a local authenticated attacker read arbitrary files. Ivanti said it had no evidence of customer exploitation before disclosure and that the issues were found through internal assessments and responsible disclosure, but the breadth of affected products increases operational risk for enterprises relying on Ivanti remote access infrastructure. The company also noted that **Pulse Connect Secure 9.x** no longer receives backported fixes because it has reached end of support.
Jun 29, 2026