Multiple Vulnerabilities in Ivanti Products Could Allow for Remote Code Execution

Multiple vulnerabilities were disclosed in Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways that allow a remote unauthenticated attacker to achieve remote code execution (CVE-2025-0282) and a local authenticated attacker to escalate privileges (CVE-2025-0283); affected versions are those before 22.7R2.5 (Connect Secure), 22.7R1.2 (Policy Secure), and 22.7R2.3 (Neurons for ZTA). Exploitation could permit installation of programs and unauthorized viewing, modification, or deletion of data on compromised systems.