CVE-2025-0282: listed in the CISA KEV catalog

CVE-2025-0282 · CVSS 9.0 CRITICAL · EPSS 100.0% · KEV 2025-01-08 · patch available

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.

Is CVE-2025-0282 exploited?

• Listed in the CISA KEV catalog on 2025-01-08.
• Federal remediation due 2025-01-15.
• Past that date by 623 days.
• Used in ransomware campaigns.
• EPSS puts exploitation in the next 30 days at 100.0%.
• Public exploit code: proof of concept.
• Public detection rules exist.

Which products and versions are affected?

• Ivanti · Connect Secure · 22.7R2 - 22.7R2.4
• Ivanti · Policy Secure · 22.7R1 - 22.7R1.2
• Ivanti · Neurons for ZTA gateways · 22.7R2 - 22.7R2.3
• ivanti · neurons for zero-trust access · 22.7

Is there a patch?

• Connect Secure 22.7R2.5
• Neurons for ZTA gateways 22.7R2.5

What PlainSec published about CVE-2025-0282

• Exposed Staging Server Shows Perimeter Breaches Spreading Inward (2026-06-19)
• 90 Zero-Days Hit Enterprise Security and Networking Devices (2026-03-07)

Primary sources

• NVD record
• CISA KEV catalog
• Exploit-DB 52213
• Nuclei template

KEV and EPSS are re-checked daily. Record last updated 2026-09-13.