CVE-2025-0282: listed in the CISA KEV catalog CVE-2025-0282 · CVSS 9.0 CRITICAL · EPSS 100.0% · KEV 2025-01-08
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
Is CVE-2025-0282 exploited? Listed in the CISA KEV catalog on 2025-01-08. Federal remediation due 2025-01-15. Past that date by 577 days. Used in ransomware campaigns. EPSS puts exploitation in the next 30 days at 100.0%. Public exploit code: proof of concept. Public detection rules exist. Which products and versions are affected? No affected package list recorded here yet.
Is there a patch? No patch identifier recorded here yet.
What PlainSec published about CVE-2025-0282 Primary sources What this record does not say No affected package data. No patch identifier. KEV and EPSS are re-checked daily. Record last updated 2026-08-15.
CVE-2025-0282: listed in the CISA KEV catalog CVE-2025-0282 · CVSS 9.0 CRITICAL · EPSS 100.0% · KEV 2025-01-08
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
Is CVE-2025-0282 exploited? Listed in the CISA KEV catalog on 2025-01-08. Federal remediation due 2025-01-15. Past that date by 577 days. Used in ransomware campaigns. EPSS puts exploitation in the next 30 days at 100.0%. Public exploit code: proof of concept. Public detection rules exist. Which products and versions are affected? No affected package list recorded here yet.
Is there a patch? No patch identifier recorded here yet.
What PlainSec published about CVE-2025-0282 Primary sources What this record does not say No affected package data. No patch identifier. KEV and EPSS are re-checked daily. Record last updated 2026-08-15.