Week in review: Exploited Ivanti Connect Secure zero-day, Patch Tuesday forecast
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-2883 | Unauthenticated RCE in Oracle WebLogic Server via T3/IIOP | 9.8 | 95% | KEV | KEV |
| CVE-2024-41713 | Unauthenticated Path Traversal in Mitel MiCollab NuPoint Unified Messaging | 9.1 | 97% | KEVRansomware | KEV |
| CVE-2024-55550 | Authenticated Path Traversal in Mitel MiCollab Enables Local File Reading | 2.7 | 38% | KEVRansomware | KEV |
| CVE-2025-0282 | Unauthenticated RCE in Ivanti Connect Secure, Policy Secure, and ZTA Gateways | 9.0 | 100% | KEVRansomwarePoC ×3 | KEV |
From the original article
4 min read at helpnetsecurity.com
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Ivanti Connect Secure zero-day exploited by attackers (CVE-2025-0282) Ivanti has fixed two vulnerabilities affecting Ivanti Connect Secure, Policy Secure and ZTA gateways, one of which (CVE-2025-0282) has been exploited as a zero-day by attackers to compromise Connect Secure VPN appliances.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.