CVE-2023-46805: Ivanti Connect Secure Auth Bypass

CVE-2023-46805 is an authentication bypass in the web component of Ivanti Connect Secure and Policy Secure gateways that lets a remote, unauthenticated attacker reach restricted resources, and — chained with the CVE-2024-21887 command-injection flaw — was used by threat actors for widespread pre-authentication remote code execution, including in ransomware campaigns.

CVE-2023-46805 is an authentication bypass (CWE-287) in the web component of Ivanti Connect Secure and Ivanti Policy Secure. A remote attacker who can reach the gateway's web interface, without any credentials, can circumvent control checks and access resources that should require authentication (NVD).

NVD's primary analysis gives CVSS v3.1 8.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N — network-reachable, low attack complexity, no privileges or user interaction required, high confidentiality impact. A CNA-reported CVSS v3.0 score of 8.2 using the same vector was separately submitted by Ivanti's bug-bounty intake (HackerOne) and matches NVD's figure (NVD).

On its own this vulnerability only allows unauthenticated access to restricted resources, but it becomes critical when chained with CVE-2024-21887, a command-injection flaw in the same product line: an attacker first uses CVE-2023-46805 to reach an authenticated administrative endpoint, then uses CVE-2024-21887 to execute arbitrary commands, giving full pre-authentication remote code execution on the appliance.

CISA added CVE-2023-46805 to the Known Exploited Vulnerabilities (KEV) catalog on 2024-01-10, with a required action to "apply mitigations per vendor instructions or discontinue use" (reflecting that a full vendor patch was not yet available at the time of listing) and a due date of 2024-01-22. The KEV catalog records known use of this CVE in ransomware campaigns (CISA KEV).

Ivanti's own vendor advisory page returned an HTTP 403 when fetched directly for this report, so affected-version detail here is sourced to NVD's CPE applicability statement instead: Ivanti Connect Secure builds 9.0 through 9.1R18 and 22.1R1 through 22.6R2, and Ivanti Policy Secure builds 9.0 through 9.1R9 and 22.1R1 through 22.6R1, are listed as vulnerable (NVD).

The joint CISA/FBI/CISA-partner advisory AA24-060B, "Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways", confirms the vulnerability "impact[s] all supported versions (9.x and 22.x)" of both products, describes threat actors chaining CVE-2023-46805 with CVE-2024-21887 to deploy web shells (including GLASSTOKEN, GIFTEDVISITOR, BUSHWALK, LIGHTWIRE and CHAINLINE variants) for persistent access, and notes that actors were able to deceive Ivanti's Integrity Checker Tool so that it failed to detect compromise. The advisory recommends limiting outbound internet connections from SSL-VPN appliances, limiting SSL-VPN connections to unprivileged accounts, keeping firmware updated, and applying vendor patches promptly (CISA Advisory AA24-060B).

As of 2026-10-20, FIRST scores the probability of exploitation at 0.99986 (99.983rd percentile) — among the highest EPSS scores tracked — consistent with a vulnerability that remains actively and widely exploited years after disclosure (FIRST EPSS).

Any Ivanti Connect Secure or Policy Secure gateway on an affected build should be treated as a priority: apply the vendor's current patched release, follow CISA's mitigation guidance, and check for indicators of prior compromise given the documented ransomware use and the fact that this flaw was exploited as part of a zero-day chain before a patch existed.

• Authentication bypass (CWE-287) in the web component of Ivanti Connect Secure and Policy Secure lets a remote, unauthenticated attacker access restricted resources by bypassing control checks. — NVD
• CVSS v3.1 base score is 8.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, matching the CNA-submitted CVSS v3.0 score of 8.2. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2024-01-10, due date 2024-01-22, required action to apply vendor mitigations or discontinue use, with known ransomware campaign use. — CISA KEV
• Affected builds per NVD's CPE applicability statement: Ivanti Connect Secure 9.0-9.1R18 and 22.1R1-22.6R2; Ivanti Policy Secure 9.0-9.1R9 and 22.1R1-22.6R1. — NVD
• Impacts all supported 9.x and 22.x versions of both products; threat actors chained this CVE with CVE-2024-21887 to deploy web shells and evade the Integrity Checker Tool. — CISA Advisory AA24-060B
• EPSS score is 0.99986 (99.983rd percentile) as of 2026-10-20. — FIRST EPSS