ClosedPatched

Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)

Ivanti Connect Secure, Policy Secure, ZTA Gateways

An unauthenticated stack buffer overflow in Ivanti Connect Secure allowed remote code execution. Mandiant saw zero-day exploitation from mid-December 2024 and SPAWN-family malware (SPAWNANT, SPAWNMOLE, SPAWNSNAIL). CISA advised factory-resetting compromised appliances before restoring them on 22.7R2.5 or later.

Why this severity: Unauthenticated RCE zero-day; CISA KEV; known ransomware use

Started: Jan 8, 2025
Closed: Jan 8, 2025
CVE: CVE-2025-0282

Follow this incident

Updated Jan 8, 2025

Affected

Connect Secure 22.7R2 through 22.7R2.4 (Policy Secure / ZTA: see Ivanti advisory)

Fixed in

Connect Secure 22.7R2.5

Timeline3

Jan 8, 2025
Ivanti discloses CVE-2025-0282 and ships Connect Secure 22.7R2.5
Source
Jan 8, 2025
Mandiant reports zero-day exploitation since mid-December 2024 with SPAWN malware
Source
Jan 8, 2025
CISA adds CVE-2025-0282 to KEV and publishes mitigation instructions
Source

Advisories4

News & write-ups2

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified