Description: Cybersecurity threat intelligence company, GreyNoise, has reported an 800 percent increase in IP scanning on Ivanti VPN's Connect Secure and Pulse Secure systems over the past week, possibly indicating preparation for potential exploitation and public disclosure of vulnerabilities. Nearly a quarter of all scanning activity for Pulse Secure and Connect Secure endpoints recorded over the past 90 days happened in a single day, with a large proportion of IPs designated as 'suspicious' or 'malicious'. Ivanti's Connect Secure has been repeatedly targeted due to its role in enterprise remote access. The company advise customers to upgrade from end-of-life products to ensure system protection against known vulnerabilities.

Description: Ivanti, a cybersecurity firm, predicts Ransomware as a top threat for 2025, with AI enhancements escalating its danger. Despite 38% of security professionals foreseeing an increased threat level, only 29% feel very prepared, indicating a significant preparedness gap. Organizations struggle with exposure management adoption, with data blind spots and tool disparities between IT and security teams. API and software vulnerabilities remain critical threats without proper visibility. Moreover, considerable tech debt interferes with security practices, growth, and innovation, ultimately affecting the strategic role of CISOs in guiding AI adoption and supply chain risk management, despite increased board-level cybersecurity discussions.

Description: Ivanti has released security updates for its Neurons for ITSM IT service management solution to mitigate a critical authentication bypass vulnerability. Tracked as CVE-2025-22462, this flaw allows unauthenticated attackers to gain administrative access to unpatched systems in low-complexity attacks. Ivanti also patched a default credentials security flaw in its Cloud Services Appliance (CSA) and a critical Connect Secure zero-day exploited by the UNC5221 China-linked espionage group. Multiple other Ivanti security flaws have been exploited in zero-day attacks over the last year.

Description: Ivanti disclosed a high-severity vulnerability (CVE-2025-22460) in its **Cloud Services Application (CSA) versions 5.0.4 and earlier**, stemming from default credentials that could allow **local authenticated attackers to escalate privileges**, leading to **full system compromise**. The flaw, rated **CVSS 7.8 (High)**, impacts **confidentiality, integrity, and availability** but lacks evidence of active exploitation. While Ivanti released **version 5.0.5** as a patch, a **critical implementation flaw** prevents automatic remediation, requiring **manual reinstallation or mitigation steps**.The vulnerability poses a **serious risk** as privilege escalation often enables broader attack chains, potentially granting adversaries **unauthorized control over enterprise systems**. Ivanti’s advisory urges immediate action, including **log reviews for suspicious activity**, given its history of critical flaws in **Connect Secure, Policy Secure, and ZTA Gateway** products earlier this year. The CSA appliance, integral to Ivanti’s **Endpoint Manager**, secures internet-based communications, making its compromise a **gateway for deeper network infiltration** if left unpatched.

Description: Chinese espionage threat actors exploited a vulnerability in Ivanti's security products, leading to the deployment of powerful malware known as Resurge. This malware campaign, detailed by the Cybersecurity and Infrastructure Security Agency (CISA) and cybersecurity firm Mandiant, has resulted in compromised system integrity and data breaches. The malware's capability to modify files, harvest credentials, create accounts, reset passwords, and escalate permissions poses a significant security threat. Ivanti has advised customers to reset devices and credentials, evidencing the severity of this security breach.

Description: The vulnerabilities CVE-2025-4427 and CVE-2025-4428 in Ivanti Endpoint Manager Mobile (EPMM) were exploited by a Chinese cyber espionage group. The attackers achieved remote code execution on internet-exposed Ivanti EPMM deployments, set up a reverse shell, deployed malware, and extracted data including IMEI, phone numbers, location, LDAP users, and Office 365 tokens. The attack affected various entities globally, including government authorities, healthcare organizations, research institutes, legal firms, telcos, manufacturers, aerospace companies, healthcare providers, and more.

Description: Ivanti experienced a severe security breach due to an unauthenticated remote code execution vulnerability, CVE-2025-22457, exploited by a China-nexus threat actor. This vulnerability, impacting Ivanti Connect Secure, Pulse Connect Secure, Ivanti Policy Secure, and ZTA Gateways, allowed attackers to execute arbitrary code remotely via a complex heap spray technique. The exploitation resulted from a failure to check buffer lengths within the application's web server binary. With patches released for some products and others pending, the incident underscores the critical importance of applying security updates promptly to avoid potential data breaches and system compromisation.

Description: Ivanti suffered a security breach due to the exploitation of the vulnerability CVE-2025-0282, which affected Ivanti Connect Secure appliances. An advanced malware known as RESURGE targeted this flaw, providing unauthorized remote code execution and privilege escalation. There were a limited number of customers directly impacted by the breach. The exploitation of this vulnerability enabled the installation of persistent web shells, credential harvesting, account creation, and elevation of attacker privileges, posing a significant threat to the confidentiality, integrity, and availability of the organization's systems and data.

Description: In the first half of 2025, Ivanti became a primary target of **UNC5221**, a suspected China-linked state-sponsored threat group exploiting multiple vulnerabilities in its products, including **Endpoint Manager Mobile, Connect Secure, and Policy Secure**. These attacks were part of a broader trend where **69% of exploited vulnerabilities required no authentication**, enabling remote execution without credentials. The exploitation of Ivanti’s edge infrastructure—critical for encrypted traffic and privileged access—posed severe risks, including **unauthorized system control, espionage, and potential lateral movement into high-value networks**. The attacks align with geopolitical motives, particularly **state-sponsored espionage and surveillance**, targeting enterprise solutions to compromise sensitive data or maintain persistent access. While the article does not specify direct data breaches or operational disruptions, the **strategic weaponization of Ivanti’s flaws** by advanced threat actors suggests high-stakes consequences, including **potential compromise of government, defense, or critical infrastructure entities** relying on these systems. The lack of authentication requirements further amplifies the threat, as attackers could **remotely execute code (RCE) with full system control**, posing existential risks to organizations dependent on Ivanti’s security appliances.

Description: In the first quarter of 2025, Ivanti Connect Secure suffered a significant ransomware attack. Threat actors targeted the company with a zero-day exploit purchased for $200,000, resulting in unauthorized remote code execution. The attack led to sensitive data exfiltration and resulted in leak site posts threatening to disclose the information if the ransom was not paid. The attack demonstrated the financial maturity of the ransomware groups, showing their ability to reinvest in sophisticated tools to perpetrate more advanced attacks. Ivanti Connect Secure experienced substantial data compromise, reputational damage, and financial implications due to the breach. This incident underscores the urgent need for enhanced cyber defenses and proactive security measures.