# CVE-2025-22457: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Source: https://junglewise.ai/threats/cve-2025-22457-ivanti-connect-secure-policy-secure-and-zta-gateways-stack-based  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-04-04. Updated: 2026-05-09  
License: CC BY 4.0 with a link back

CVE-2025-22457 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2025-04-04

A stack-based buffer overflow vulnerability in Ivanti Connect Secure, Policy Secure, and ZTA Gateways allows a remote unauthenticated attacker to achieve remote code execution. The vulnerability is caused by an out-of-bounds write (CWE-787) and has been observed being exploited in the wild.

Technologies: [Ivanti Connect Secure](https://junglewise.ai/threats/technologies/connect-secure), [Ivanti Neurons](https://junglewise.ai/threats/technologies/neurons), [Ivanti Policy Secure](https://junglewise.ai/threats/technologies/policy-secure). Vendors: [Ivanti](https://junglewise.ai/threats/vendors/ivanti).

## Quick answers

**Is CVE-2025-22457 exploited in the wild?** Yes. CVE-2025-22457 is known to be exploited in the wild, first recorded on 4 April 2025. Treat it as urgent.

**How severe is CVE-2025-22457?** Critical severity, with a CVSS score of 9.8, published 4 April 2025.

**Which products and versions are affected?** Ivanti Connect Secure before 22.7R2.6; Ivanti Policy Secure before 22.7R1.4; Ivanti ZTA Gateways before 22.8R2.2.

**Is there a fix for CVE-2025-22457?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-22457 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-22457?** Check whether you run Ivanti Connect Secure, Ivanti Neurons, Ivanti Policy Secure or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Ivanti Connect Secure before 22.7R2.6
- Ivanti Policy Secure before 22.7R1.4
- Ivanti ZTA Gateways before 22.8R2.2

## Timeline

- 2025-04-04: disclosed
- 2025-04-04: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2025-04-04: advisory: Ivanti April Security Advisory published
- 2025-04-08: other: Initial NIST analysis completed
- 2025-05-02: other: CISA KEV entry updated

## Related threats

- [Ivanti Connect Secure predictable identifier generation](https://junglewise.ai/threats/cve-2026-118527-ivanti-connect-secure-generation-of-predictable-numbers-or)
- [Ivanti Connect Secure privilege escalation via DSCache configuration](https://junglewise.ai/threats/cve-2026-111357-ivanti-connect-secure-22-8r2-4-mishandles-the-manner-in-which)
- [Ivanti Connect Secure authentication bypass by spoofing](https://junglewise.ai/threats/cve-2026-104935-ivanti-connect-secure-authentication-bypass-by-spoofing)
- [Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability](https://junglewise.ai/threats/cve-2025-0282-ivanti-connect-secure-policy-secure-and-zta-gateways-stack-based)
- [Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability](https://junglewise.ai/threats/cve-2024-21893-ivanti-connect-secure-policy-secure-and-neurons-server-side)