Ivanti Neurons For Zero-Trust Access vulnerabilities

5 CVEs affecting Ivanti Neurons For Zero-Trust Access, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-0283, published 2025-01-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-21893: Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability, published 2024-01-31. High severity, CVSS 8.2. Actively exploited: in CISA KEV since 2024-01-31. EPSS: 100% chance of exploitation in the next 30 days. A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access…
CVE-2025-0282: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability, published 2025-01-08. Critical severity, CVSS 9.0. Actively exploited: in CISA KEV since 2025-01-08. EPSS: 100% chance of exploitation in the next 30 days. A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a…
CVE-2025-0283, published 2025-01-08. High severity, CVSS 7.0. EPSS: 17.5% chance of exploitation in the next 30 days. A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a…
CVE-2022-35258, published 2022-12-05. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure…
CVE-2022-35254, published 2022-12-05. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure…