The National Cyber Security Centre renewed calls for councils to patch Ivanti Connect Secure VPN appliances after Essex County Council disclosed anomalous login patterns consistent with exploitation of stack-based buffer overflows that vendors and NCSC analysts have tracked since January.

Daniel Okeke writes: Essex said it isolated the affected gateway within hours, found no evidence that payroll or electoral systems were reached, and reported the incident to the NCSC under the national cyber security centre’s standard co-ordination process. The case is a reminder that local government remote-access kit remains a favourite target while ransomware crews probe edge devices before hitting Windows domains.

Technical picture

CVE-2025-0282 allows unauthenticated remote code execution on unpatched Connect Secure builds before version 22.7R2.5. A companion privilege-escalation flaw, CVE-2025-0283, matters once attackers establish a foothold. Ivanti has published integrity-checker tooling and factory-reset guidance for compromised appliances.

Essex’s IT provider ran the vendor integrity checker overnight and replaced hardware certificates on staff laptops that tunnel through the VPN. neighbouring authorities in the East of England received a regional warning via the Local Government Association’s cyber resilience group.

Why councils lag

Public sector networks often schedule VPN maintenance in narrow overnight windows to avoid disrupting social-care rota systems. Several authorities still run dual-vendor VPN estates after pandemic-era rush deployments. The NCSC’s Thursday note stressed that Policy Secure gateways should not be internet-exposed even when patched.

Funding is another constraint. Ministry of Housing, Communities and Local Government cyber grants help, but patch teams compete with Windows 10 end-of-life migrations and Microsoft 365 phishing simulations mandated by audit committees.

Broader Ivanti exposure

Separate NHS England alerts cover Ivanti Endpoint Manager Mobile zero-days, a different product line but the same vendor name that confuses non-specialist boards. NCSC officials asked NHS trusts not to conflate the advisories when reporting status up to integrated care boards.

Scottish public-sector buyers recently renewed Ivanti endpoint licences via framework call-offs, citing ransomware lessons from the 2017 WannaCry period. That spend does not replace timely VPN patching on English councils, but it shows how deeply Ivanti tooling runs through UK government IT.

Defensive steps

Security architects recommend multi-factor authentication on all VPN profiles, geo-fencing admin interfaces, and shipping logs to SOC platforms that baseline failed handshake rates. Essex credited an uptick in failed login alerts — tripped at 03:14 BST Wednesday — for fast detection.

For residents, there is no action required unless the council contacts you about identity monitoring. Essex said its public website and online payment portal were not hosted on the VPN appliance and remained available throughout.

What happens next

The NCSC will publish aggregated sector guidance if more councils report similar anomalies. Until then, any authority still on pre-22.7R2.5 Connect Secure builds should treat patching as a same-day priority, not a change-window nice-to-have. Essex’s experience suggests the exploits are not theoretical — and winter ransomware campaigns are only beginning.