Ivanti warns that hackers exploited a vulnerability in Connect Secure. Through that vulnerability, they installed malware on devices.
A vulnerability in Connect Secure allowed hackers to remotely execute code in zero-day attacks. This allows them to install malware on devices.
Research started
The vulnerability was discovered after Ivanti’s Integrity Checker Tool (ICT) flagged suspicious activity at customer sites. Ivanti immediately released a patch for Connect Secure. However, the vulnerability also affects Ivanti Policy Secure and Ivanti Neurons for ZTA Gateways. That patch will not be released until Jan. 21. The company stresses that good configuration management is crucial to minimize risk.
Administrators are advised to perform ICT scans and apply a factory reset in case of suspicious activity before installing the latest firmware. Ivanti is more often targeted by hackers as it is not the first time vulnerabilities in Connect Secure have been exploited. Last year alone, five vulnerabilities were discovered in two months.
In addition to CVE-2025-0282, a second vulnerability (CVE-2025-0283) has also been addressed. This bug, which enables local misuse, is currently not actively exploited. Ivanti is working with security agencies to further investigate the attacks.