Ivanti Connect Secure

Why this is on the list

Published on CISA Known Exploited Vulnerabilities evidence. Exploitation is confirmed by CISA; the exact affected version range and vendor fixed build are not yet vendor-confirmed. Remediation follows CISA's required action. This entry upgrades automatically when the vendor advisory is ingested.

• CISA added this to its Known Exploited Vulnerabilities Catalog on 2025-04-04.
• CISA records it as having been used in ransomware campaigns.

Does this apply to your version?

No vendor-confirmed affected range has been published for this finding yet. That means we can confirm the vulnerability is being exploited, but we cannot yet say which releases are affected — and it should not be read as meaning every version is vulnerable, or that any particular version is safe.

What to do

Apply the vendor-fixed release or documented mitigation as a priority; this vulnerability is known to be exploited.

• CISAPrimary government source

  Confirms active exploitation · Informs severity

  Vulnerability is exploited in the wild (CISA KEV listing)

  Read the CISA record↗
• CVE RecordCNA-supplied evidence

  Defines affected versions · Defines the fixed release · Determines whether a version is affected

  CNA-published affected versions and remediation

  Read the CVE record↗
• FIRSTSupporting intelligence

  Informs severity

  EPSS estimates a >99% probability that this vulnerability will be exploited in the next 30 days. It is a forecast about the vulnerability, not a statement about whether your installation is affected.

  About EPSS↗

How this was assessed

• CVE-2025-22457 triggered rule KEV_KNOWN_EXPLOITED
• CISA KEV lists it as known-exploited
• EPSS 0.9998
• no affected version range is available for the mapped product
• Patient Protect score 72 (HIGH) under pp-risk-1.0
• remediation provenance: PP_TEMPLATE
• evidence incomplete