OMENWAVE modelled vulnerability-chaining pathways

CVE-2025-0282

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.

9.0
CVSS Critical
100.0%
EPSS p100
YES
In CISA KEV
YES
Ransomware-linked

Data as of 2 Nov 2026 · NVD, CISA KEV, EPSS

Why chaining, at machine speed

Defenders still triage vulnerabilities one CVE at a time, while increasingly automated attackers combine them at machine speed. Omenwave models the plausible pathways by which this CVE could be chained with others — surfacing them for research and awareness, with evidence for each step.

Modelled capability profile
Kill-chain stage
INITIAL_ACCESS
Requires
NONE access, NETWORK vector
Grants
PRIV access
Capabilities
code executionprivilege gain
Model confidence
high · CVSS 3.1
Top plausible next hops
CVE-2019-11539INITIAL_ACCESS → EXECUTIONhigh plausibility · KEV

The access level the source grants already meets or exceeds the access level the destination requires — the position carries over.

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse P…

CVE-2020-8260INITIAL_ACCESS → EXECUTIONhigh plausibility · KEV

The access level the source grants already meets or exceeds the access level the destination requires — the position carries over.

A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution…

CVE-2020-8243INITIAL_ACCESS → EXECUTIONhigh plausibility · KEV

The access level the source grants already meets or exceeds the access level the destination requires — the position carries over.

A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform…

CVE-2025-49704INITIAL_ACCESS → EXECUTIONhigh plausibility · KEV

The access level the source grants already meets or exceeds the access level the destination requires — the position carries over.

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2022-41040INITIAL_ACCESS → EXECUTIONhigh plausibility · KEV

The access level the source grants already meets or exceeds the access level the destination requires — the position carries over.

Microsoft Exchange Server Elevation of Privilege Vulnerability

Open in the interactive explorer →
Embed this snapshot

Paste this into a blog post or report — it renders a compact, exploit-free chain snapshot.

Modelled plausible chaining potential derived from public CVE metadata (CVSS, CWE, CPE). Not a confirmed real-world exploit chain and contains no exploitation detail. For research and awareness only.

Methodology · Interactive explorer · JSON: /cve/CVE-2025-0282