Dive Brief:

• The Shadowserver Foundation found 5,113 Ivanti VPN instances that are vulnerable to CVE-2025-22457, a critical stack-based buffer overflow flaw that affects Ivanti Connect Secure.

• The vulnerability has already been exploited in the wild. Mandiant observed a suspected Chinese nation-state threat group exploiting CVE-2025-22457 in a cyber espionage activity that began in mid-March. The Cybersecurity and Infrastructure Security Agency added the flaw to its known exploited vulnerabilities catalog on Friday.

• CVE-2025-22457 affects other products such as Pulse Connect Secure, Ivanti Policy Secure and ZTA gateways. However, both Ivanti and Mandiant said the vulnerability has only been exploited against the Ivanti Connect Secure VPN devices.

Dive Insight:

According to scans run on April 6, Shadowserver found 5,113 vulnerable Ivanti Connect Secure instances, with the majority located in the U.S., Japan and China. Shadowserver scan results for Monday show a slight drop in vulnerable devices to 5,027.

However, Shadowserver noted that CVE-2025-22457 affects more than just Ivanti Connect Secure devices. "Note that according to Ivanti, the vulnerability was patched in a Feb 11, 2025 release. However, a large set of what is affected are older Pulse Connect Secure 9.x (end-of-support as of December 31, 2024) without a patch," Shadowserver said in a post on X Monday.

According to Ivanti's advisory for CVE-2025-22457, Pulse Connect Secure 9.1x versions no longer receive any code changes. "Ivanti cannot provide guidance to customers to stay on an unsupported version. Customers' only option is to migrate to a secure platform to ensure their security," the advisory said.

However, Ivanti said the risk of exploitation against other products is lower. For Ivanti Policy Secure, the company said the risk is "greatly reduced as it is not intended to be internet facing." A patch will be released for Ivanti Policy Secure on April 21, the advisory said.

For Ivanti ZTA Gateways, the advisory said the CVE cannot be exploited while instances are in production. "If a gateway for this solution is generated and left unconnected to a ZTA controller, then there is a risk of exploitation on the generated gateway," Ivanti said, adding that a patch is scheduled to be released on April 19.

Prior to public disclosure, Ivanti released a patch in February addressing CVE-2025-22457 Ivanti Connect Secure with version 22.7R2.6. But at that time, Ivanti mistakenly believed that the flaw was low-risk and could only be used in denial-of-service attacks. However, Mandiant later discovered exploitation activity on CVE-2025-22457 that involved China-nexus actors achieving remote code execution on vulnerable VPNs.