Ivanti Fully Patched Connect Secure RCE Vulnerability That Actively Exploited in the Wild

Ivanti disclosed CVE-2025-22457, a CVSS 9.0 stack-based buffer overflow in Ivanti Connect Secure, Pulse Connect Secure, Ivanti Policy Secure and ZTA Gateways that has been actively exploited since mid‑March 2025 by suspected China-linked UNC5221 to achieve unauthenticated RCE; Ivanti released patches (Connect Secure 22.7R2.6 and subsequent platform updates), recommends factory reset and redeploy for compromised appliances, and Mandiant and others have published IOCs and detection guidance—organizations are urged to patch or migrate immediately, especially unsupported systems.