Loading story…
Ivanti remediated CVE-2025-0282, a CVSS 9.0 unauthenticated remote-code-execution flaw affecting Ivanti Connect Secure and Policy Secure appliances. Ivanti warned that the vulnerability was being actively exploited, and public proof-of-concept code was released, increasing the risk of opportunistic compromise. The company also fixed CVE-2025-0283, a CVSS 7.0 local privilege-escalation vulnerability.
Organizations should apply Ivanti’s updates immediately and use the Ivanti Integrity Checker Tool to identify indicators of compromise. Where compromise is detected, Ivanti advises resetting affected appliances to factory defaults and following its recovery process; defenders should also monitor surrounding networks and credentials for malicious activity or persistence.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers published proof-of-concept code for CVE-2025-0282, increasing the likelihood of broader exploitation of the actively exploited Connect Secure vulnerability.
Ivanti remediated CVE-2025-0282, an actively exploited unauthenticated remote code-execution flaw in Connect Secure, and CVE-2025-0283, a local privilege-escalation flaw affecting Connect Secure and Policy Secure. Ivanti also released its Integrity Checker Tool and Mandiant published related indicators of compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers globally exploited `CVE-2023-46805` and `CVE-2024-21887` in Ivanti Connect Secure and Ivanti Policy Secure gateways, chaining the flaws to achieve unauthenticated remote code execution with administrator privileges. The affected products included supported Connect Secure 9.x and 22.x releases and supported Policy Secure versions; because the appliances are commonly internet-facing, compromise could enable data theft, lateral movement, and ransomware deployment. Ivanti issued updates for specified Connect Secure and ZTA versions, while CISA warned that the vendor's initial mitigations and detection guidance might not fully address the threat. Ivanti also disclosed `CVE-2024-21888` and `CVE-2024-21893`, for which proof-of-concept code became public; organizations were urged to apply updates immediately, factory-reset affected appliances where recommended, and use mitigations only until patches could be installed.
Sep 3, 2026
Ivanti disclosed security updates for **Ivanti Connect Secure**, **Ivanti Policy Secure**, and **Ivanti Neurons for ZTA gateways** to address `CVE-2025-0282` and `CVE-2025-0283`. The most serious flaw, `CVE-2025-0282`, is a **critical stack-based buffer overflow** with a CVSS score of **9.0** that enables **unauthenticated remote code execution** and has been actively exploited against Ivanti Connect Secure appliances. The second issue, `CVE-2025-0283`, is a **high-severity** flaw with a CVSS score of **7.0** that can allow a **local authenticated attacker to escalate privileges**. According to CSIRT.SK, citing JPCERT/CC, attackers have used `CVE-2025-0282` to deploy the **SPAWNCHIMERA** malware framework, which combines **SPAWNANT**, **SPAWNMOLE**, and **SPAWNNAIL** and includes functionality intended to prevent reinfection by competing threat actors. Ivanti urged customers to **urgently patch affected systems**, verify appliance integrity with the **Integrity Checker Tool**, and consider performing a **factory reset before patching** if compromise is suspected.
Aug 21, 2026
Ivanti disclosed multiple critical vulnerabilities affecting **Ivanti Connect Secure**, **Ivanti Policy Secure**, and **Ivanti Neurons for ZTA Gateway**, including `CVE-2025-0282` (CVSS 9.0), a stack-based buffer overflow that allows unauthenticated remote code execution, and `CVE-2025-0283` (CVSS 7.0), which enables privilege escalation. Ivanti said `CVE-2025-0282` has been exploited in the wild against Ivanti Connect Secure, prompting urgent guidance for organizations to upgrade to fixed releases and use the **Integrity Checker Tool** to look for signs of compromise. Authorities later warned that `CVE-2025-22457` is also being actively exploited in **Ivanti Connect Secure** and **Pulse Connect Secure**, allowing remote command execution on vulnerable systems. Ivanti Connect Secure addressed that flaw in version **22.7R2.6**, but **Pulse Connect Secure 9.x** has no patch and will not receive one, leaving migration and retirement as the only mitigation for legacy deployments. While Ivanti Policy Secure and ZTA Gateway are also affected by `CVE-2025-22457`, exploitation had not been observed in those products at the time of reporting.
Jun 29, 2026