[HIGH PRIORITY] Ivanti Connect Secure Stack Overflow RCE (CVE-2025-22457)

⚠ HIGH PRIORITY — CISA KEV. CVE-2025-22457 is a stack-based buffer overflow in Ivanti Connect Secure, Policy Secure, and ZTA gateways. Unauthenticated remote attackers achieve RCE on internet-facing VPN appliances — active mass exploitation confirmed.

Affected Ivanti builds

• Connect Secure before 22.7R2.6
• Policy Secure before 22.7R1.4
• ZTA gateways before fixed release per Ivanti advisory

Check version immediately

show version
curl -sk https://vpn.example.com/ | grep -i ivanti

Patching Method

1. Emergency change window — treat as P1 incident if VPN is internet-facing.
2. Download Ivanti security patch 22.7R2.6 (or latest advisory build) from Ivanti support portal.
3. Apply via admin UI: Maintenance → System → Upgrade/Patch or upload vendor patch bundle per KB.
4. Reboot appliance when required; verify show version shows patched build.
5. Run Ivanti External Attack Surface Tool (EAST) or ICT scan for compromise.
6. Rotate all VPN user passwords, SAML/OAuth secrets, and admin credentials.

# Post-patch hunt on Linux-based ICS (if shell access available)
last -20
find /var -mtime -7 -name '*.sh' 2>/dev/null
grep -i 'failed\|admin' /var/log/messages | tail -50

Until patched

• Disable internet-facing VPN portal at firewall
• Restrict to known IP allowlist only
• Assume breach if unpatched and exposed > 48 hours