# Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282) · pwn.watch

> An unauthenticated stack buffer overflow in Ivanti Connect Secure allowed remote code execution. Mandiant saw zero-day exploitation from mid-December 2024 and SPAWN-family malware (SPAWNANT, SPAWNMOLE, SPAWNSNAIL). CISA advised factory-resetting compromised appliances before restoring them on 22.7R2.5 or later.

Page: https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282 · generated 2026-10-22T23:13:41.393Z

## Status
- Severity: critical · status: closed · patch: patched
- Product: Ivanti Connect Secure, Policy Secure, ZTA Gateways
- Started: 2025-01-08 · closed: 2025-01-08
- CVEs: CVE-2025-0282
- Affected: Connect Secure 22.7R2 through 22.7R2.4 (Policy Secure / ZTA: see Ivanti advisory)
- Fixed in: Connect Secure 22.7R2.5

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282/feed.xml
- JSON Feed: https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282.json
- This file: https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282/llms.txt

## Updates (newest first)
- 2025-01-08: Ivanti discloses CVE-2025-0282 and ships Connect Secure 22.7R2.5 (https://www.bleepingcomputer.com/news/security/ivanti-warns-of-new-connect-secure-flaw-used-in-zero-day-attacks/)
- 2025-01-08: Mandiant reports zero-day exploitation since mid-December 2024 with SPAWN malware (https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day/)
- 2025-01-08: CISA adds CVE-2025-0282 to KEV and publishes mitigation instructions (https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282)

## Fix brief
# Security brief: Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)

Source: https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282 · status: closed (closed Jan 8, 2025) · severity: critical · updated Jan 8, 2025

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
An unauthenticated stack buffer overflow in Ivanti Connect Secure allowed remote code execution. Mandiant saw zero-day exploitation from mid-December 2024 and SPAWN-family malware (SPAWNANT, SPAWNMOLE, SPAWNSNAIL). CISA advised factory-resetting compromised appliances before restoring them on 22.7R2.5 or later.

Severity detail: Unauthenticated RCE zero-day; CISA KEV; known ransomware use

- Product: Ivanti Connect Secure, Policy Secure, ZTA Gateways
- CVE / advisory ids: CVE-2025-0282

## Affected versions
- Connect Secure 22.7R2 through 22.7R2.4 (Policy Secure / ZTA: see Ivanti advisory)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- Connect Secure 22.7R2.5

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Jan 8, 2025: Ivanti discloses CVE-2025-0282 and ships Connect Secure 22.7R2.5
- Jan 8, 2025: Mandiant reports zero-day exploitation since mid-December 2024 with SPAWN malware
- Jan 8, 2025: CISA adds CVE-2025-0282 to KEV and publishes mitigation instructions

## Advisories
- [CISA Mitigation Instructions for CVE-2025-0282](https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282) (CISA)
- [Active exploitation of vulnerability affecting Ivanti Connect Secure](https://www.ncsc.gov.uk/news/active-exploitation-ivanti-vulnerability) (NCSC UK)
- [NVD: CVE-2025-0282](https://nvd.nist.gov/vuln/detail/CVE-2025-0282) (NVD)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (CISA)

## Write-ups & news
- [Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation](https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day/)
- [CVE-2025-0282: Ivanti Connect Secure Zero-Day Exploited in the Wild](https://www.rapid7.com/blog/post/2025/01/08/etr-cve-2025-0282-ivanti-connect-secure-zero-day-exploited-in-the-wild/)

---
Machine-readable: https://pwn.watch/i/ivanti-connect-secure-zero-day-cve-2025-0282.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.