Log in Request a demo

Exploited vulnerability

Ivanti authentication bypass (CVE-2023-46805)

CVE-2023-46805

CVE-2023-46805 is an authentication bypass in the web component of Ivanti Connect Secure and Ivanti Policy Secure.

  • On CISA KEV
CVE ID
CVE-2023-46805
CISA KEV
Listed
Affected product
Connect Secure and Policy Secure
Exploited
Yes
Published
January 2024

In short

CVE-2023-46805 is an authentication bypass in the web component of Ivanti Connect Secure and Ivanti Policy Secure. It lets a remote attacker reach restricted parts of the appliance. It was exploited together with CVE-2024-21887 and is listed by CISA as exploited.

Profile MapVulnerability
  1. CVECVE-2023-46805
  2. ProductIvanti Connect Secure and Policy Secure
  3. CISA KEVListedKnown Exploited Vulnerabilities
  4. ExploitedYesin real attacks
  5. Fix Steps2actions listed

What it allows

NVD describes this as an authentication bypass in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure. A remote attacker can reach restricted resources by bypassing control checks. NVD scores it 8.2 (CVSS 3.1, high): it can be reached over the network with no privileges and no user action, with a high impact on confidentiality and a low impact on integrity. On its own it exposes restricted resources. In the Ivanti chain it is the first step, because it removes the login that CVE-2024-21887 needs.

Who is affected

Per NVD, the affected products are Ivanti Connect Secure (ICS) 9.x and 22.x and Ivanti Policy Secure. Connect Secure was formerly known as Pulse Connect Secure. Ivanti released information on this flaw on 10 January 2024, the day CISA added it to its Known Exploited Vulnerabilities catalog with a due date of 22 January 2024. NVD published its record on 12 January 2024.

The full attack timeline, CISA Emergency Directive 24-01, the February 2024 re-release and the response steps are told once, on the page for CVE-2024-21887, the command injection this bypass unlocks.

What to do

  1. Update to the latest Ivanti release

    Ivanti replaced its early updates with new ones on 8 February 2024. Use the current supported release from Ivanti, not the temporary XML mitigation.

  2. Treat the appliance as possibly compromised

    Because this bypass was used with CVE-2024-21887, the integrity check, credential rotation and hunting steps from CISA are listed on the CVE-2024-21887 page.

Questions

What is CVE-2023-46805?

It is an authentication bypass in the web component of Ivanti Connect Secure and Policy Secure. A remote attacker can reach restricted resources without logging in properly. Combined with CVE-2024-21887, CISA says it lets an attacker run commands on the appliance.

Is CVE-2023-46805 being exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 10 January 2024 and issued Emergency Directive 24-01 on 19 January. It reported widespread exploitation by multiple threat actors who captured credentials and dropped webshells.

What does CVE-2023-46805 give an attacker on its own?

NVD says a remote attacker can reach restricted resources by bypassing control checks, with no login and no user action. It does not run commands by itself. Chained with CVE-2024-21887, CISA says it lets an attacker run commands on the appliance.

Which Ivanti products are affected by CVE-2023-46805?

Ivanti Connect Secure (versions 9.x and 22.x) and Ivanti Policy Secure are affected. Connect Secure was formerly known as Pulse Connect Secure. Ivanti released information on both this flaw and CVE-2024-21887 on 10 January 2024.

In our research

  1. KEV due-date windows and pace of additions October 2026
  2. DragonForce Ransomware: From Hacktivism to High-Street Extortion September 2025

Sources

  1. Emergency Directive 24-01 CISA
  2. CVE-2023-46805 record NIST National Vulnerability Database
  3. Known Exploited Vulnerabilities catalog (JSON feed) CISA

Last updated October 2026

Browse the threat library

Keep exploring

Knowledge Hub