Ivanti

Ivanti experienced a severe security breach due to an unauthenticated remote code execution vulnerability, CVE-2025-22457, exploited by a China-nexus threat actor. This vulnerability, impacting Ivanti Connect Secure, Pulse Connect Secure, Ivanti Policy Secure, and ZTA Gateways, allowed attackers to execute arbitrary code remotely via a complex heap spray technique. The exploitation resulted from a failure to check buffer lengths within the application's web server binary. With patches released for some products and others pending, the incident underscores the critical importance of applying security updates promptly to avoid potential data breaches and system compromisation.

Source: https://cybersecuritynews.com/ivanti-0-day-rce-vulnerability/

TPRM report: https://scoringcyber.rankiteo.com/company/ivanti

"id": "iva916041125",
"linkid": "ivanti",
"type": "Vulnerability",
"date": "4/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'industry': 'cybersecurity',
                        'name': 'Ivanti',
                        'type': 'organization'}],
 'attack_vector': 'unauthenticated remote code execution vulnerability',
 'description': 'Ivanti experienced a severe security breach due to an '
                'unauthenticated remote code execution vulnerability, '
                'CVE-2025-22457, exploited by a China-nexus threat actor. This '
                'vulnerability, impacting Ivanti Connect Secure, Pulse Connect '
                'Secure, Ivanti Policy Secure, and ZTA Gateways, allowed '
                'attackers to execute arbitrary code remotely via a complex '
                'heap spray technique. The exploitation resulted from a '
                "failure to check buffer lengths within the application's web "
                'server binary. With patches released for some products and '
                'others pending, the incident underscores the critical '
                'importance of applying security updates promptly to avoid '
                'potential data breaches and system compromisation.',
 'impact': {'systems_affected': ['Ivanti Connect Secure',
                                 'Pulse Connect Secure',
                                 'Ivanti Policy Secure',
                                 'ZTA Gateways']},
 'lessons_learned': 'The critical importance of applying security updates '
                    'promptly to avoid potential data breaches and system '
                    'compromisation.',
 'post_incident_analysis': {'root_causes': 'failure to check buffer lengths '
                                           "within the application's web "
                                           'server binary'},
 'response': {'remediation_measures': ['patches released for some products']},
 'threat_actor': 'China-nexus threat actor',
 'title': 'Ivanti Security Breach',
 'type': 'remote code execution',
 'vulnerability_exploited': 'CVE-2025-22457'}