Actively Exploited Ivanti Connect Secure RCE Requires Immediate Remediation

Ivanti remediated CVE-2025-0282, a CVSS 9.0 unauthenticated remote-code-execution flaw affecting Ivanti Connect Secure and Policy Secure appliances. Ivanti warned that the vulnerability was being actively exploited, and public proof-of-concept code was released, increasing the risk of opportunistic compromise. The company also fixed CVE-2025-0283, a CVSS 7.0 local privilege-escalation vulnerability.

Organizations should apply Ivanti’s updates immediately and use the Ivanti Integrity Checker Tool to identify indicators of compromise. Where compromise is detected, Ivanti advises resetting affected appliances to factory defaults and following its recovery process; defenders should also monitor surrounding networks and credentials for malicious activity or persistence.