These vulnerabilities impact the core architecture of Ivanti’s access solutions, with each flaw allowing attackers primarily with authenticated access to bypass critical security controls and take over vulnerable systems.

CVE-2025-22457 is a new addition to the list and involves improper handling of file operations, which can allow an authenticated attacker to write arbitrary files on the system. This file write vulnerability, if chained with other flaws, can lead to code execution or backdoor implantation. It affects Ivanti Connect Secure versions prior to 22.7R2.5 and Policy Secure versions prior to 22.7R1.3.

CVE-2025-22467 is a stack-based buffer overflow vulnerability, allowing attackers to overwrite memory and execute arbitrary code. This flaw, found in versions of Connect Secure before 22.7R2.6, is especially dangerous as it can grant full control over the system to an attacker with session access. Rated CVSS 9.9, it is the most severe of the group.

CVE-2024-38657 impacts Connect Secure prior to 22.7R2.4 and Policy Secure before 22.7R1.3, allowing administrators (or compromised admin sessions) to manipulate file names and paths, effectively writing files to arbitrary locations. This could be used to deploy malware, overwrite legitimate files, or maintain unauthorized persistence.

CVE-2024-10644 allows for remote command injection via crafted requests submitted by an authenticated admin. Once exploited, it could give attackers access to system-level operations, enabling data theft, privilege escalation, or malware deployment. Like the previous, it affects versions prior to 22.7R2.4.

Together, these vulnerabilities present a potent risk, especially when chained. Attackers could combine file write and command injection capabilities to execute persistent malware, bypass monitoring tools, and pivot deeper into the network.