CVE-2025-0282

Ivanti Connect Secure, Policy Secure, and ZTA Gateways suffered a stack-based buffer overflow allowing unauthenticated remote code execution.

A stack-based buffer overflow in Ivanti's security gateways enables unauthenticated remote code execution, directly compromising Zero Trust Architecture (ZTA) and remote access controls. DIB organizations must urgently patch these products, as the vulnerability is actively exploited in the wild and linked to ransomware campaigns. Failure to patch exposes critical network perimeters to arbitrary code execution, violating CMMC/NIST 800-171 requirements for patch management and system integrity.

Shame score — A critical RCE vulnerability in a Zero Trust gateway was actively exploited in the wild and linked to ransomware, indicating severe negligence in patch management and security hygiene.