CVE-2025-22457

What it actually does

CVE-2025-22457 is a stack-based buffer overflow in Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti ZTA Gateways that can be triggered remotely without authentication. Successful exploitation allows attacker-controlled data to overwrite process memory and execute arbitrary code on the appliance, typically with the privileges of the vulnerable service. Because these products sit at the network edge and often broker VPN, access-policy, or zero-trust connectivity, code execution on the appliance can enable persistence, traffic interception, credential theft, lateral movement, and manipulation of security controls.

Why it matters to the business

This is a critical, internet-exposed remote code execution issue affecting remote-access infrastructure, with confirmed active exploitation, inclusion in CISA KEV, extremely high EPSS probability, and reported ransomware use. Compromise can give attackers a foothold into internal networks, disrupt VPN or access services, steal credentials and session material, and support ransomware deployment. Organizations running vulnerable Ivanti Connect Secure, Policy Secure, or ZTA Gateway versions should treat exposure as an urgent incident-response priority, not routine patching; CISA’s KEV remediation deadline was 2025-04-11.

How an attack unfolds

An attacker identifies an exposed Ivanti Connect Secure, Policy Secure, or ZTA Gateway appliance running a vulnerable version. They send a crafted unauthenticated request to the vulnerable service, causing a stack buffer overflow and redirecting execution flow to attacker-controlled code. Once code execution is obtained, the attacker can run commands on the appliance, deploy in-memory or on-disk malware, alter appliance components, harvest credentials or session tokens, proxy traffic, and use the appliance as a trusted entry point into downstream systems. Public reporting associates exploitation activity with active in-the-wild campaigns against Ivanti edge devices, including malware and vulnerability-trend reporting from Q2/H1 2025, and CISA has marked the vulnerability as exploited and associated with ransomware activity.

How to fix it

Upgrade all affected Ivanti products to fixed or later versions: Ivanti Connect Secure 22.7R2.6 or later, Ivanti Policy Secure 22.7R1.4 or later, and Ivanti ZTA Gateways 22.8R2.2 or later. If immediate upgrade is not possible, restrict management and user-facing access to trusted networks, enforce upstream access controls, disable unnecessary exposure, and monitor aggressively; however, network filtering should be treated only as a temporary risk reduction measure, not a fix. Because the vulnerability is actively exploited and present in CISA KEV with ransomware association, organizations with exposed vulnerable appliances should run Ivanti’s recommended integrity checks and incident-response procedures. If compromise is suspected, preserve evidence, isolate the appliance, rotate credentials and certificates that may have traversed or resided on the appliance, rebuild or factory-reset according to vendor guidance, and only return the device to service after upgrading and validating integrity.

How to confirm the fix worked

Confirm the installed product and version from the appliance administrative interface or vendor-supported command-line/status tooling. The appliance should report Ivanti Connect Secure 22.7R2.6 or later, Ivanti Policy Secure 22.7R1.4 or later, or Ivanti ZTA Gateway 22.8R2.2 or later, as applicable. Run the vendor-provided internal and external integrity checker tools and review any mismatch, unexpected file, crash, or malware-related finding as potentially serious. Validate that exposed interfaces are no longer reachable from untrusted networks unless business-required, and confirm compensating controls are in place. From vulnerability management platforms, rescan internet-facing assets and verify no vulnerable Ivanti appliance versions remain. If the appliance was upgraded after possible exposure, perform post-upgrade compromise assessment rather than assuming the patch removed an existing attacker foothold.

Typical attack path

1. Scan the internet for exposed Ivanti Connect Secure, Ivanti Policy Secure, or Ivanti ZTA Gateway interfaces.
2. Fingerprint the appliance and infer whether it is running a vulnerable release.
3. Send a crafted unauthenticated request that triggers the stack-based buffer overflow.
4. Achieve remote code execution in the vulnerable service context.
5. Stage commands, malware, or a memory-resident backdoor on the appliance.
6. Collect credentials, session tokens, configuration data, logs, certificates, or network-access material.
7. Use the compromised appliance to proxy into internal resources or bypass normal access controls.
8. Establish persistence and attempt to evade integrity checks or forensic review.
9. Move laterally, exfiltrate data, or support ransomware deployment.

How to detect it

Investigate both direct exploitation of the appliance and follow-on activity that used the appliance as a trusted access path. Review Ivanti appliance system, event, admin, VPN/session, web/request, and integrity-check logs for the period before and after patching, especially around unexpected service crashes, restarts, segmentation faults, core dumps, integrity-check failures, unexplained configuration changes, new administrative users, unusual authentication events, and anomalous outbound connections. Correlate with firewall, proxy, DNS, EDR, identity-provider, VPN, and privileged-access logs for traffic sourced from the appliance to unusual internal destinations or external infrastructure. Look for evidence of malware families and activity names publicly associated with Ivanti edge-device exploitation, including BRUSHFIRE, TRAILBLAZE, and SPAWN-related tooling, while recognizing that exploitation may be memory-resident and leave limited file artifacts. Pay special attention to successful authentications from unusual geographies, impossible travel, atypical session durations, large data transfers, use of dormant accounts, and internal access that begins shortly after appliance crashes or integrity-check anomalies. If logs show exploitation indicators or the integrity checker reports modifications, preserve the appliance image/logs where possible, isolate it, rotate secrets, and proceed under an incident-response process.

• BRUSHFIRE
• TRAILBLAZE
• SPAWN
• SPAWNCHIMERA
• SPAWNSLOTH
• SPAWNSNARE
• stack-based buffer overflow
• segmentation fault
• segfault
• core dumped
• core dump
• Integrity Checker
• integrity check failed
• unexpected file
• modified file
• clientCapabilities
• Ivanti Connect Secure 22.7R2.5
• Ivanti Connect Secure 22.7R2.4
• Ivanti Policy Secure 22.7R1.3
• Ivanti ZTA Gateway 22.8R2.1

What your security team should do

• Immediately inventory all Ivanti Connect Secure, Policy Secure, and ZTA Gateway appliances, including internet-facing and partner-accessible instances.
• Patch or upgrade to Ivanti Connect Secure 22.7R2.6+, Policy Secure 22.7R1.4+, or ZTA Gateway 22.8R2.2+ as applicable.
• Treat any vulnerable internet-exposed appliance as potentially compromised because exploitation is active in the wild, EPSS is extremely high, the issue is in CISA KEV, and ransomware use is reported.
• Run Ivanti integrity checks and preserve logs, core dumps, configuration snapshots, and forensic artifacts before reimaging or resetting suspected systems.
• Hunt for suspicious appliance crashes, unexpected file changes, new or modified web-accessible files, unauthorized administrative actions, unusual outbound connections, and unexplained VPN/session activity.
• Rotate local administrative credentials, directory bind credentials, API keys, certificates, and other secrets that may have been stored on or passed through affected appliances.
• Segment or restrict appliance access so management interfaces are reachable only from trusted administrative networks.
• Review downstream authentication, VPN, and privileged-access logs for lateral movement originating from the appliance or from accounts that authenticated through it.
• If compromise is suspected, isolate the appliance, engage incident response, rebuild from trusted media or follow vendor factory-reset guidance, then upgrade before reconnecting.
• Track CISA KEV and Ivanti advisories for updated indicators, detection tooling, and hardening instructions.