Back attackerkb.com

2c7673d5 C3c5 4f02 Ba7c 4fa0927b06ac

attackerkb.com • June 17, 2026

AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database . If available, please supply below:

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.

AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database . If available, please supply below:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Remote Code Execution Vulnerability Exploited by China-Nexus Actor On April 3, 2025, Ivanti disclosed CVE-2025-22457, a critical buffer overflow vulnerability affecting Ivanti Connect Secure and other products. The vulnerability allows unauthenticated remote code execution, and evidence of exploitation was observed in mid-March 2025. Threat actor UNC5221, linked to China, successfully exploited the vulnerability, deploying new malware families TRAILBLAZE and BRUSHFIRE. The patch for this vulnerability was released on February 11, 2025, but the threat actor managed to reverse engineer it to exploit earlier versions. Ivanti and Mandiant have urged customers to upgrade their systems immediately to mitigate the risk. The incident highlights the ongoing threat posed by state-sponsored actors who can exploit vulnerabilities even after patches are issued. 2 sources 81

Extracted Entities

2c7673d5 C3c5 4f02 Ba7c 4fa0927b06ac

The full story

Extracted Entities

Companies (1)

CWE Weaknesses (1)

Platforms (2)