Avanti's Critical Zero-Day Vulnerability

Avanti has announced that threat actors have exploited a critical-rated zero-day vulnerability in its widely used Connect Secure VPN tool, allowing unauthorized access to corporate networks. This vulnerability, identified as CVE-2025, can be exploited without authentication, enabling attackers to remotely plant malicious code within Avanti's products. The company, which claims its Connect Secure solution is crucial for organizations of all sizes, recently acknowledged a wave of security issues that have affected its products in the past. While a patch for Connect Secure is available, updates for two other affected products, Policy Secure and ZTA Gateways, will not be released until later in January.