CVE Watch4 ago 2026

CVE-2025-22457

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

CVSS

9.0

Crítico

EPSS

100.0%

p100

KEV

SÍ

4 abr 2025

Exploit Today

0-100

Publicado: 3 abr 2025 · Última mod.: 4 ago 2026 · CWE-121 · CWE-787

EPSS · 30d

100.0%EPSS · 30 días100.0%

2026-09-162026-10-14

Ficha del catálogo KEV

Producto

Ivanti / Connect Secure, Policy Secure, and ZTA Gateways

Vulnerabilidad

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Añadido a KEV

4 abr 2025

Remediar antes de

11 abr 2025

Uso conocido en ransomware

Sí

Descripción resumida

Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.

Acción requerida

Apply mitigations as set forth in the CISA instructions linked below.

Notas

CISA Mitigation Instructions: https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-22457 ; Additional References: https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457 ; https://nvd.nist.gov/vuln/detail/CVE-2025-22457

Descripción técnica

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-58098—

—

———When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is only 15 bits wide. If enough semaphore sets are created and destroyed in the same table slot while a caller is blocked, the counter wraps around, and semop(2) may falsely conclude that the original set still exists. The subsequent access to a semaphore within the set may then be out of bounds. An unprivileged local user can trigger an out-of-bounds access on kernel heap memory, potentially leading to privilege escalation.6h CVE-2026-101307—

—

———When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection. A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.6h CVE-2025-29897—

—

———A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 and later6h CVE-2026-766637.5 ALT

—

———A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.10h CVE-2026-766625.9 MED

—

———A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS.10h CVE-2026-737997.5 ALT

—

———A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption11h