Loading story…
China-nexus threat actors exploited remote code execution flaws in Ivanti Connect Secure VPN appliances to breach multiple organizations, according to TeamT5. The reporting links intrusions to abuse of Ivanti vulnerabilities including CVE-2025-22457, and follows earlier attention on CVE-2025-0282, a pre-authentication RCE tied to a TLS stack overflow in the product's IFT component. The activity shows continued attacker focus on internet-facing Ivanti gateways as an initial access path into enterprise environments.
Public exploit development accompanied the disclosures, with GitHub repositories publishing proof-of-concept code and scanner tooling for both CVE-2025-22457 and CVE-2025-0282. The availability of PoCs lowers the barrier for follow-on exploitation and increases pressure on defenders to patch exposed Ivanti Connect Secure systems, hunt for signs of compromise on VPN appliances, and review access originating from those devices into internal networks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A second GitHub repository focused on CVE-2025-22457 is published by TRone-ux, further expanding public availability of proof-of-concept material for the Ivanti Connect Secure flaw.
TeamT5 publishes research stating that a China-linked APT exploited an Ivanti Connect Secure VPN vulnerability to infiltrate multiple organizations, adding attribution and victim-scope details to the campaign narrative.
A GitHub repository by securekomodo publishes a Python exploit/PoC scanner for CVE-2025-22457 targeting Ivanti Connect Secure, making detection or exploitation details publicly available.
A public proof-of-concept repository for CVE-2025-0282, described as an Ivanti Connect Secure IFT TLS stack overflow leading to pre-authentication remote code execution, is published on GitHub by watchTowr Labs.
4 references tracked. Mallory keeps watching after this page renders.
teamt5.org
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ivanti disclosed multiple critical vulnerabilities affecting **Ivanti Connect Secure**, **Ivanti Policy Secure**, and **Ivanti Neurons for ZTA Gateway**, including `CVE-2025-0282` (CVSS 9.0), a stack-based buffer overflow that allows unauthenticated remote code execution, and `CVE-2025-0283` (CVSS 7.0), which enables privilege escalation. Ivanti said `CVE-2025-0282` has been exploited in the wild against Ivanti Connect Secure, prompting urgent guidance for organizations to upgrade to fixed releases and use the **Integrity Checker Tool** to look for signs of compromise. Authorities later warned that `CVE-2025-22457` is also being actively exploited in **Ivanti Connect Secure** and **Pulse Connect Secure**, allowing remote command execution on vulnerable systems. Ivanti Connect Secure addressed that flaw in version **22.7R2.6**, but **Pulse Connect Secure 9.x** has no patch and will not receive one, leaving migration and retirement as the only mitigation for legacy deployments. While Ivanti Policy Secure and ZTA Gateway are also affected by `CVE-2025-22457`, exploitation had not been observed in those products at the time of reporting.
Jun 29, 2026
Mandiant reported that the suspected China-linked espionage actor **UNC5221** actively exploited **`CVE-2025-22457`**, a critical buffer overflow in **Ivanti Connect Secure** VPN appliances, to achieve remote code execution on devices running **22.7R2.5 and earlier**. The activity reportedly began by at least mid-March, with Mandiant assessing that the attackers likely identified the opportunity by reverse-engineering a February patch for the vulnerability. After gaining access, UNC5221 deployed two newly identified malware families, **TRAILBLAZE** and **BRUSHFIRE**, alongside components from the previously documented **SPAWN** malware ecosystem. Mandiant said the intrusion set reflects the group’s continued emphasis on compromising internet-facing edge devices and warned organizations to upgrade affected Ivanti Connect Secure appliances to **22.7R2.6 or later** immediately.
Jun 29, 2026
Ivanti released fixes for a newly disclosed high-severity flaw in its on-premises Endpoint Manager Mobile (**EPMM**) platform, tracked as `CVE-2026-6973`, after confirming limited zero-day exploitation. The vulnerability is caused by improper input validation and can lead to arbitrary code execution when a remote attacker already has administrator-level access. Ivanti said the issue affects EPMM `12.8.0.0` and earlier and issued patched versions `12.6.1.1`, `12.7.0.1`, and `12.8.0.1`, while urging customers to review privileged accounts and rotate credentials. The disclosure adds to a longer pattern of Ivanti security incidents: CISA previously warned that `CVE-2023-35082`, a critical authentication bypass flaw in Ivanti EPMM and MobileIron Core, was being actively exploited to gain unauthenticated API access, expose user data, and potentially backdoor servers when chained with other vulnerabilities. ConnectWise also disclosed a critical vulnerability in **ConnectWise Automate**, tracked as `CVE-2026-9089`, affecting versions prior to `2026.5`. The flaw, classified as `CWE-494`, stems from insufficient integrity verification during plugin loading and self-update operations and could allow malicious code execution on client machines during agent updates under specific network conditions. ConnectWise assigned the issue a CVSS score of **8.8**, automatically updated cloud deployments, and instructed on-premises customers to manually upgrade to version `2026.5`; Canada’s Cyber Centre separately urged administrators to apply the vendor update. The disclosures highlight continued risk across widely deployed enterprise management platforms, with internet exposure data showing hundreds of Ivanti EPMM systems and broad operational dependence on remote monitoring and mobile device management software.
Jun 29, 2026