Zero-day exploits plague Ivanti Connect Secure appliances for second year running

Ivanti disclosed two stack-based buffer overflow vulnerabilities—CVE-2025-0282 (critical, exploited in the wild for unauthenticated RCE) and CVE-2025-0283 (high, local privilege escalation)—affecting Connect Secure, Policy Secure, and Neurons for ZTA gateways; Mandiant and other responders observed exploitation beginning in mid-December with malware families (Spawn, Dryhook, Phasejam) tied to UNC5337/UNC5221 and warned of likely opportunistic widespread exploitation, urging immediate patching and taking affected appliances offline where patches are delayed.