Embed Notice

Now, regarding the "silent fix" of CVE-2025-22457, which per Ivanti:

This vulnerability has been remediated in Ivanti Connect Secure 22.7R2.6 (released February 11, 2025)

That word remediated...

Careful readers will see that Ivanti didn't fix the vulnerability in 22.7R2.6.

What changed in 22.7R2.6? With this version, Ivanti compiled some of the ICS binaries with exploit mitigations that have been around for 20 years. And wouldn't you know it, it paid off already? Everybody's gotta learn sometime...