CVE-2025-22457

Ivanti · Published April 3, 2025

9.0

CVSS v3.1

CRITICAL

CISA KEV — Federal agencies must patch by deadline

Actively exploited in the wild

Patch availableGet patch

Description

Ivanti Connect Secure, Policy Secure, and ZTA Gateways stack-based buffer overflow allowing remote code execution. A China-nexus threat actor (UNC5221) exploited this before patches were available, deploying TRAILBLAZE and BRUSHFIRE malware.

Affected Products

Ivanti Connect Secure < 22.7R2.6
Ivanti Policy Secure (all versions)
Ivanti ZTA Gateways < 22.8R2.2

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Related Advisories

CVECRITICALCVE-2025-22457

Ivanti Connect Secure Zero-Day (CVE-2025-22457) Exploited by China-Nexus UNC5221

A critical stack-based buffer overflow in Ivanti Connect Secure VPN was exploited as a zero-day by UNC5221 (China-nexus) to deploy TRAILBLAZE dropper and BRUSHFIRE passive backdoor on edge devices globally.

WHY IT MATTERS

If you run Ivanti Connect Secure for remote access, assume compromise until the Integrity Checker Tool clears your appliance.

IvantiVPNRemote Code Execution+3 more

Apr 3, 2025· 5 min read