CVE Intel / CVE-2025-0282
CVE-2025-0282
connect secure · ivanti
⚠
Actively exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue: exploitation confirmed in the wild. Patch on priority.
What it is
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
Live exploitation on the huntback network (30 days)
4
attempts captured
4
distinct source IPs
2026-09-26
last seen
huntback carries a network signature for this CVE. Exploitation attempts are detected on the decoy fleet in real time.
How huntback helps
Deploy a decoy that emulates connect secure and you will see every attempt at this CVE the moment it lands, with the full payload, the attacker's infrastructure, and any stage-2 loader. Then huntback can scan the attacker back.
CVSSn/a Critical
EPSS1.00 (99% pct)
In CISA KEVyes
Publishedn/a
Network detectableyes, signatured
Public exploitExploitDB