DaystoPatch

IvantiExploited incident

Ivanti Connect Secure unauthenticated stack overflow exploited as a zero-day (January 2025)

CVE-2025-0282, CVE-2025-0283Critical, CVSS 9.0In CISA's Known Exploited Vulnerabilities catalog since 8 Jan 2025

  • Exploited before a fix
  • Known ransomware use
FixedA fix existed when the bug went public. No evidence yet of when every version was fixed.
Embed this live clock

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
not dated
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Mandiant / Google Threat Intelligence blogCuratedQuote verified

    Mandiant has identified zero-day exploitation of CVE-2025-0282 in the wild beginning mid-December 2024.

    Post dated January 8, 2025.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:16312892e7cd25fa…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    CISA KEV (CVE-2025-0282)ClaimedQuote verified8 Jan 2025

    Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

    Added to CISA's KEV catalog on 2025-01-08.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Ivanti blog: Security Update for Connect Secure, Policy Secure and Neurons for ZTA Gateways (Wayback snapshot 2025-01-08 21:37 UTC)CuratedQuote verified8 Jan 2025

    We are aware of a limited number of customers’ Ivanti Connect Secure appliances which have been exploited by CVE-2025-0282 at the time of disclosure.

    Ivanti's disclosure (blog 'Last updated: January 08, 2025', captured by 21:37Z) and Mandiant's report the same day are the first public signals. Mandiant: exploitation began mid-December 2024.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef154ee2f553a1fc…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet8 Jan 2025, 18:06 UTC

    CVE-2025-0282 and CVE-2025-0283

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-0282ClaimedQuote verified8 Jan 2025, 22:15 UTC

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:452cea271fb7594f…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet9 Jan 2025, 05:45 UTC

    CVE Alert: CVE-2025-0282 - https://www. redpacketsecurity.com/cve_aler t_cve-2025-0282/ # OSINT # ThreatIntel # CyberSecurity # cve_2025_0282

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet10 Jan 2025, 18:26 UTC

    https://labs.watchtowr.com/do-secure-by-design-pledges-come-with-stickers-ivanti-connect-secure-rce-cve-2025-0282/

    Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    same day

    CVE record CVE-2025-0282 (CNA: Ivanti)CuratedQuote verified

    "datePublished":"2025-01-08T22:15:09.386Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:452cea271fb7594f…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Ivanti blog (Wayback snapshot 2025-01-08 21:37 UTC)CuratedQuote verified8 Jan 2025

    We are reporting the vulnerabilities as CVE-2025-0282 and CVE-2025-0283.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef154ee2f553a1fc…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Ivanti blog (Wayback snapshot 2025-01-08 21:37 UTC)CuratedQuote verified

    A fix is available now in our standard download portal.

    Connect Secure 22.7R2.5 was available at disclosure (Mandiant recommends reimaging and returning to production on 22.7R2.5).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef154ee2f553a1fc…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    No evidence yet of fixed releases for every supported branch.

Send this to your boss

Ivanti Connect Secure VPN zero-day exploited since mid-December; fix Jan 8, 2025

Attackers exploited an unauthenticated code execution flaw in Ivanti Connect Secure VPNs for weeks before Ivanti released 22.7R2.5 on 8 January 2025.

In plain words

Ivanti's Connect Secure VPN, used for remote access, had a critical flaw that attackers exploited from mid-December 2024, before a fix existed. Ivanti released the fix on 8 January 2025. If we use Ivanti VPNs, they must be on fixed software, and because attacks predate the fix we need to run Ivanti's integrity check and rebuild any device that shows signs of compromise.

What happened and who is affected

What happened

On 8 January 2025 Ivanti disclosed CVE-2025-0282, a stack-based buffer overflow that lets an unauthenticated attacker run code on Ivanti Connect Secure, Policy Secure and Neurons for ZTA gateways, together with CVE-2025-0283. Ivanti said a limited number of Connect Secure appliances had been exploited, and Mandiant reported exploitation since mid-December 2024. A fixed Connect Secure release was available at disclosure; fixes for Policy Secure and ZTA gateways followed.

Who is affected

Ivanti Connect Secure before 22.7R2.5, Ivanti Policy Secure before 22.7R1.2 and Ivanti Neurons for ZTA gateways before 22.7R2.3.

CVE-2025-0282, CVE-2025-0283. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/ivanti-cve-2025-0282/

Affected products

  • Ivanti Connect Secure
  • Ivanti Policy Secure
  • Ivanti Neurons for ZTA gateways
How we built this timeline

Zero-day: exploitation from mid-December 2024 (Mandiant), acknowledged at disclosure. CVE-2025-0283 (local privilege escalation, not in KEV) fixed in the same advisory.

KEV 8 Jan 2025 (ransomware use Known). Fixed for all versions omitted: the CVE record lists Policy Secure 22.7R1.2 and ZTA gateways 22.7R2.3 as fixed versions, but their release dates (believed to be later in January 2025) could not be evidenced from a fetchable source; the Ivanti advisory is JavaScript-only.

Ivanti CVSS 9.0. The current Ivanti blog has a rewritten 'Key Takeaways' header; the first-day Wayback copy is cited.

Related

Ivanti report card