Critical Security Flaw in Ivanti VPN Appliances: What You Need to Know

In today’s interconnected world, the security of Virtual Private Networks (VPNs) is paramount. Recently, a critical vulnerability in Ivanti Connect Secure VPN appliances has raised alarm bells across the cybersecurity landscape. With over 5,000 instances of unpatched vulnerabilities still active, this flaw has the potential to affect a vast number of organizations globally. Let’s dive into the details of this security risk and explore what businesses can do to mitigate it.

the Vulnerability

A significant security vulnerability, tracked as CVE-2025-22457, continues to jeopardize the safety of Ivanti Connect Secure VPN appliances worldwide. Discovered through scans, it was revealed that over 5,100 instances of unpatched appliances remained vulnerable as of April 6, 2025. This flaw, marked as a stack-based buffer overflow with a CVSS score of 9.0, affects multiple Ivanti products, including Connect Secure, Pulse Connect Secure, Policy Secure, and ZTA Gateways.

The vulnerability, which was exploited in the wild by suspected Chinese threat actors, allows unauthenticated remote attackers to execute arbitrary code. This could lead to the complete compromise of affected systems. Mandiant, a security research firm, found evidence that this vulnerability had been actively exploited since mid-March 2025, targeting Ivanti Connect Secure VPN appliances running version 22.7R2.5 and earlier, as well as the now unsupported Pulse Connect Secure 9.x products.

Initially, the flaw was thought to be a low-risk denial-of-service issue due to its limited character space. However, further analysis revealed its true potential for remote code execution. Despite Ivanti’s patch released in February 2025, the flaw remained critical, as it allowed attackers to exploit previous versions for system compromise.

Once the vulnerability is successfully exploited, attackers deploy malware such as the TRAILBLAZE dropper and the BRUSHFIRE backdoor. These attacks are attributed to UNC5221, a China-linked espionage group known for targeting critical edge devices. The threat actors seemingly reversed-engineered Ivanti’s patch to exploit earlier versions of the VPN appliance.

As of now, ShadowServer scan data shows thousands of instances that remain vulnerable, underscoring the critical need for organizations to update their systems. Ivanti has issued several patch releases, with key dates including:

Ivanti Connect Secure: Patch version 22.7R2.6 (available since February 11, 2025)
Pulse Connect Secure 9.x: End-of-support as of December 31, 2024; migration required
Ivanti Policy Secure: Patch expected April 21, 2025

– ZTA Gateways: Patch expected April 19, 2025

Organizations using affected versions should update immediately, while those still on Pulse Connect Secure 9.x are encouraged to contact Ivanti for assistance with migration.

Ivanti also recommends monitoring for signs of compromise by using their Integrity Checker Tool (ICT) and checking for web server crashes. If an organization detects any indication of compromise, a factory reset and upgrade to version 22.7R2.6 should be performed immediately.

What Undercode Says:

The security breach involving Ivanti Connect Secure VPN appliances underscores the importance of timely patching and effective vulnerability management. The fact that thousands of unpatched instances are still in use globally highlights a critical issue in organizational cybersecurity practices. Despite patches being available since February 2025, many systems remain exposed due to insufficient attention or slow implementation of updates.

The vulnerability in question, CVE-2025-22457, is a stack-based buffer overflow, a well-known vulnerability type that can lead to remote code execution if exploited. This particular flaw was initially misjudged as a low-risk denial-of-service threat. However, as cybersecurity researchers like Mandiant have pointed out, the ability of attackers to achieve full system compromise means this vulnerability poses a serious threat.

The exploitation of this flaw by a sophisticated espionage group, UNC5221, is another critical aspect of the situation. The threat actor’s ability to reverse-engineer Ivanti’s patch and exploit older versions of the appliance shows the level of determination and sophistication behind the attack. This type of advanced threat actor typically targets edge devices, which makes the vulnerability even more dangerous, as these devices often sit at critical points of the network infrastructure.

The role of the Cybersecurity and Infrastructure Security Agency (CISA) in adding the vulnerability to their Known Exploited Vulnerabilities (KEV) catalog highlights the increasing recognition of this flaw’s severity. This catalog serves as a call to action for organizations to prioritize the patching of vulnerabilities that are actively being exploited in the wild.

Given the sophistication of the attack and the potential for widespread impact, it is essential for organizations to take a proactive approach to security. The use of security tools like Ivanti’s Integrity Checker Tool, alongside routine vulnerability assessments and patch management, should become standard practice for every organization. The longer these vulnerabilities go unpatched, the higher the risk of a catastrophic breach.

Moreover, organizations that are still using outdated versions of Pulse Connect Secure or other affected Ivanti products should take swift action to either migrate to supported versions or seek assistance from Ivanti in managing the transition. The risks of leaving systems unpatched or unsupported are simply too high, especially when adversaries are actively exploiting such vulnerabilities.

Fact Checker Results:

The vulnerability CVE-2025-22457 has been actively exploited by suspected Chinese threat actors.
Thousands of unpatched Ivanti appliances remain vulnerable, showing the urgency of updating systems.
Ivanti’s recommendation for organizations includes monitoring the Integrity Checker Tool (ICT) and performing factory resets on compromised appliances.