Introduction
Remote attackers can crash enterprise VPN and zero trust gateways used by thousands of organizations worldwide, which cuts off access to critical business resources. CVE-2025-5462 is a heap-based buffer overflow in Ivanti Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access, disclosed alongside several other vulnerabilities in August 2025.
About Ivanti: Ivanti sells enterprise IT and security products to a global customer base that spans government, finance, healthcare, and critical infrastructure. Its Connect Secure and Policy Secure products are widely deployed for remote access and zero trust network architectures. The company has faced a series of high-profile vulnerabilities in 2025, so defenders are paying close attention to its patch management and security posture.
Technical information
CVE-2025-5462 is a heap-based buffer overflow vulnerability (CWE-122) that affects multiple Ivanti products. The flaw is in shared code across:
- Connect Secure (prior to 22.7R2.8 or 22.8R2)
- Policy Secure (prior to 22.7R1.5)
- ZTA Gateway (prior to 22.8R2.3-723)
- Neurons for Secure Access (prior to 22.8R1.4)
A remote unauthenticated attacker can send specially crafted input to network-accessible interfaces. Because that input is not properly validated, it can overflow heap-allocated memory buffers and corrupt memory. The most likely outcome is denial of service, with the application crashing or terminating unexpectedly. The attack needs no authentication or prior access, which raises the risk for exposed Ivanti appliances.
No public code snippets or proof-of-concept details are available. The root cause is insufficient bounds checking before user-supplied data is copied into heap-allocated buffers, a classic memory-safety issue in C or C++ codebases. The flaw can disrupt normal program execution and, if chained with other vulnerabilities, may expose the system to further exploitation.
Patch information
Ivanti has released security updates for multiple vulnerabilities in its Connect Secure, Policy Secure, and Neurons for Zero Trust Access (ZTA) gateways. These vulnerabilities, identified as CVE-2025-0282 and CVE-2025-0283, could allow unauthorized access and remote code execution on affected systems.
Patch Availability:
- Ivanti Connect Secure: Version 22.7R2.5 and later
- Ivanti Policy Secure: Version 22.7R1.2 and later
- Ivanti Neurons for ZTA Gateways: Version 22.7R2.3 and later
Recommended Actions:
-
Upgrade promptly to the versions listed above to fix the identified vulnerabilities.
-
Run Ivanti's external Integrity Checker Tool (ICT) before and after applying the updates to detect any signs of compromise. Running the ICT requires a restart of the gateway appliances.
-
After updating, keep monitoring your systems for unusual activity to confirm the patches are working.
Affected systems and versions
- Ivanti Connect Secure: All versions before 22.7R2.8 or 22.8R2
- Ivanti Policy Secure: All versions before 22.7R1.5
- Ivanti ZTA Gateway: All versions before 22.8R2.3-723
- Ivanti Neurons for Secure Access: All versions before 22.8R1.4
Vendor security history
Ivanti has had several critical vulnerabilities in 2025, including:
- CVE-2025-22457: Buffer overflow, actively exploited by advanced threat actors
- CVE-2025-0282: Unauthenticated remote code execution, exploited as a zero day
- Multiple buffer overflows, XML external entity flaws, and privilege escalation issues across Connect Secure, Policy Secure, and ZTA Gateway
Ivanti runs a monthly security update cycle and has published advisories and rapid patches in response to recent vulnerabilities. Still, the frequency and impact of these issues point to ongoing security problems across its products.
