CVE-2025-22457: Ivanti Connect Secure VPN Vulnerable to Zero-Day RCE Exploitation

On 3 April 2025, Ivanti disclosed a critical zero-day vulnerability, CVE-2025-22457, affecting Ivanti Connect Secure, Policy Secure, and ZTA Gateways. This stack-based buffer overflow allows remote unauthenticated threat actors to achieve remote code execution (RCE) and has been exploited in the wild. At the time of writing, exploitation has only been observed in Connect Secure, not Policy Secure or ZTA Gateway. As a result, Ivanti prioritised patching Connect Secure first, with patches for the other products expected later in April. 

Campaign Details

Google Threat Intelligence observed the exploitation of CVE-2025-22457 as early as mid-March 2025 and attributed the activity to the suspected China-nexus espionage group UNC5221. This threat actor is known to target edge devices across a wide range of countries and industries, leveraging the SPAWN ecosystem malware. The campaign, documented by Google, involved malware deployment after exploitation to carry out malicious activities, including data exfiltration, backdoor installation, and log tampering. 

Recommendation For CVE-2025-22457

Upgrade to Latest Fixed Version

Arctic Wolf strongly recommends that customers upgrade to the latest fixed version. 

Please follow your organisation’s patching and testing guidelines to minimise potential operational impact. 

References 

• Ivanti Security Advisory 

• Google Threat Intelligence Blog Post

Resources

Understand the threat landscape, and how to better defend your organization, with the 2025 Arctic Wolf Threat Report

See how Arctic Wolf utilizes threat intelligence to harden your attack surface and stop threats earlier and faster