A new public exploit repository for an old and serious flaw landed on our watch this week. CVE-2025-22457 is a pre-authentication, unauthenticated remote-code-execution bug in Ivanti Connect Secure and its siblings, the VPN appliances that guard remote access into hospitals, utilities, agencies, and plant networks. The vulnerability is not new, it was disclosed and patched in early 2025 and tied to China-nexus espionage, but a fresh proof-of-concept, published this week, is a reminder that the exposure has not gone away.
Ivanti Connect Secure, formerly Pulse Connect Secure, is one of the most widely deployed enterprise VPN and remote-access appliances in the world. It sits at the network edge and terminates the VPN, authenticates users, and decides who gets to reach internal applications. In many organizations it is the front door: the single box that stands between the public internet and everything inside, including the boundary between the IT network and the operational-technology network. Ivanti Policy Secure and the ZTA Gateways are close relatives in the same access-control family, and Pulse Connect Secure is the older, now end-of-support lineage. CVE-2025-22457 affects all of them.
The flaw is a classic memory-safety bug in the appliance's HTTP request handling. Security researchers report that the affected products do not properly validate the length of data supplied in a client-controlled HTTP header, the X-Forwarded-For header, and that an overly long value overruns a fixed-size stack buffer. What makes the story unusual is the second act. As Mandiant described it, the overflow used "a limited character space, and therefore it was initially believed to be a low-risk denial-of-service vulnerability," which is why Ivanti's February patch went out as a routine bug fix rather than a security emergency. The attackers studied that patch, found a way around the character-space limitation, and produced reliable remote code execution.
At a conceptual level the mechanism is straightforward even though the exploitation is not. The appliance copies attacker-controlled data from an incoming web request into a stack buffer without adequately checking how long that data is. Send more than the buffer can hold and the excess spills over adjacent stack memory, including the saved control data that decides where the program jumps next. Control that, and you control execution. Because the request is processed before any authentication, the attacker needs no credentials and no session, only network reach to the appliance's web interface.
The appliance trusts the length of a value it should have bounded. Overflow the buffer with a crafted request, steer where the code runs next, and a device with no login has handed over remote execution.
We want to be honest about difficulty, because it matters to how you weigh the risk. This is not a trivial one-line exploit. The overflow works within a restricted set of allowed characters, which is precisely why it was first written off as a denial-of-service issue, and turning it into stable code execution took real effort: careful memory manipulation to avoid simply crashing the service. Independent researchers at Rapid7 later reproduced full remote code execution and described the vulnerability as "not trivial to exploit." That difficulty is exactly why a fresh, public proof-of-concept is worth noting. Public exploit code lowers the bar. Work that once required a capable nation-state team to rediscover from a patch becomes something a much wider set of actors can pick up and run.
Following successful exploitation in the original 2025 campaign, Mandiant observed the deployment of two malware families: TRAILBLAZE, an in-memory-only dropper, and BRUSHFIRE, a passive backdoor. In-memory and passive tooling of that kind is chosen to survive on an appliance that offers defenders very little visibility, and to be hard to find after the fact. That is the payload profile of an actor interested in quiet, persistent access rather than noise.
We want to be precise about scope, the same way we are with the other edge-appliance items we cover. Ivanti Connect Secure is IT infrastructure, not an industrial control system, and CVE-2025-22457 is not an ICS advisory. We are flagging it under our operational-technology and critical-infrastructure watch for a specific and, we think, defensible reason: enterprise VPN appliances like this one are among the internet-facing edge devices that most often bridge into those environments. In hospitals, utilities, water systems, transportation, and manufacturers, the Ivanti box is frequently the remote-access chokepoint that stands between the public internet and the internal network, including the IT-to-OT boundary. A pre-authentication code-execution bug on that device is a weakness in the perimeter that protects everything behind it.
The actor history is the reason to take it seriously. The original exploitation was attributed to UNC5221, a suspected China-nexus espionage group that specializes in zero-day exploitation of edge appliances, and the campaign reached organizations globally, including in the United States. Ivanti's product line has been a repeated target of edge-focused intrusion sets over the past several years, and this class of appliance sits exactly where an initial foothold does the most damage: at the trusted seam where remote users, contractors, and sometimes OT vendors cross into the network. We are not claiming a new industrial exploit. We are saying a widely deployed access-control appliance with a documented nation-state exploitation history just got a fresh public exploit, and that device class is squarely in the path we watch.
We run a fleet of honeypots and edge decoys, and this is the kind of issue that sits in our lane. The vulnerability is reached by sending network traffic to an internet-facing appliance, which is exactly what our decoys are built to emulate and observe. Unlike a purely cloud-side or local-only bug, an attacker has to touch the network-facing web interface to attempt it.
The observable footprint is concrete. Reconnaissance against Ivanti Connect Secure typically starts with fingerprinting the appliance and its version banner, so bursts of requests probing for Ivanti or Pulse login paths are a natural precursor. Exploitation of this specific flaw involves abnormally long or malformed values in the client HTTP request, including oversized X-Forwarded-For headers aimed at the appliance's web endpoints, and failed attempts tend to crash the web server, so appliance instability and restart patterns are a signal in their own right. A decoy that presents as an Ivanti-style remote-access appliance is well placed to catch that reconnaissance and any early exploitation attempts, and to do so without exposing a real device.
The primary fix has been available for more than a year, which changes the nature of the advice. This is now a patch-hygiene and exposure question rather than a scramble for an emergency update. If you run these appliances, the fresh proof-of-concept is a good prompt to confirm that the fixed builds are actually deployed everywhere, including on any forgotten or end-of-support boxes, and to look for signs that an unpatched device was already touched.
22.7R2.6 (released 2025-02-11). Vulnerable: ICS ≤ 22.7R2.5, Policy Secure ≤ 22.7R1.3, ZTA Gateways ≤ 22.8R2, Pulse Connect Secure (EoS) ≤ 9.1R18.922.7R2.6 or later. Ivanti Policy Secure and ZTA Gateways received their fixes later in April 2025, so verify those are current too. Do not assume a fleet is covered because the flagship appliances are; inventory every instance.22.7R2.6 or later. Treat integrity-checker results as a signal, not a guarantee, and rebuild if exploitation is suspected regardless.| Type | Detail |
|---|---|
| CVE | CVE-2025-22457, stack-based buffer overflow (CWE-121), pre-auth unauthenticated RCE, CVSS 9.8 Critical |
| Product | Ivanti Connect Secure, Pulse Connect Secure, Ivanti Policy Secure, ZTA Gateways |
| Vector | Crafted HTTP request with an over-length client header (reported as X-Forwarded-For) overflowing a stack buffer in pre-auth request handling |
| Affected | ICS ≤ 22.7R2.5, Policy Secure ≤ 22.7R1.3, ZTA Gateways ≤ 22.8R2, Pulse Connect Secure (EoS) ≤ 9.1R18.9 |
| Fixed | ICS 22.7R2.6 (2025-02-11); Policy Secure and ZTA Gateways patched April 2025; Pulse Connect Secure 9.1x not patched (end of support) |
| Post-exploit | TRAILBLAZE in-memory dropper and BRUSHFIRE passive backdoor, per Mandiant, in the original 2025 campaign |
| Attribution | Suspected China-nexus actor UNC5221; in-the-wild exploitation from mid-March 2025 |
| Public PoC | New public exploit repository for CVE-2025-22457 created on GitHub 2026-07-10 (independent PoC-in-GitHub gate). We do not link, download, or run PoC code |
| KEV | Added to CISA Known Exploited Vulnerabilities in April 2025 |