{"id":"CVE-2023-46805","published":"2024-01-12T17:15:09Z","modified":"2026-10-01T21:17:17Z","title":"Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability","vendor":"Ivanti","product":"Connect Secure and Policy Secure","tier":"core","eol":null,"description":{"text":"An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.","provenance":"source","from":"NVD"},"summary":{"text":"An authentication bypass flaw in the web component of Ivanti Connect Secure and Policy Secure, affecting Ivanti ICS 9.x and 22.x and Ivanti Policy Secure, lets a remote attacker reach restricted resources by getting past access control checks. The attacker needs only network access to the affected web interface, with no authentication and no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:54:14Z"},"cvss":{"score":8.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.99984,"percentile":0.99982,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2024-01-10","dueDate":"2024-01-22","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"Please apply mitigations per vendor instructions. For more information, please see: https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US ;  https://nvd.nist.gov/vuln/detail/CVE-2023-46805","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-01-10","exploitedFirstSeen":"2024-01-10","ransomware":true,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-01-10"},{"url":"https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/","date":"2024-01-10"},{"url":"https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day","date":"2024-01-12"},{"url":"https://www.volexity.com/blog/2024/01/15/ivanti-connect-secure-vpn-exploitation-goes-global","date":"2024-01-15"},{"url":"https://www.volexity.com/blog/2024/01/15/ivanti-connect-secure-vpn-exploitation-goes-global/","date":"2024-01-15"},{"url":"https://unit42.paloaltonetworks.com/threat-brief-ivanti-cve-2023-46805-cve-2024-21887/","date":"2024-01-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-18&host_type=src&vulnerability=cve-2023-46805","date":"2024-01-18"},{"url":"https://www.volexity.com/blog/2024/01/18/ivanti-connect-secure-vpn-exploitation-new-observations/","date":"2024-01-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-19&host_type=src&vulnerability=cve-2023-46805","date":"2024-01-19"},{"url":"https://northwave-cybersecurity.com/whitepapers-articles/investigating-a-possible-ivanti-compromise","date":"2024-01-19"}],"evidenceTotal":947,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"ARMORY CASTLE Exploits BeyondTrust","url":"https://otx.alienvault.com/pulse/6ad9e67ca1c7d1ceba4d86e7","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46805","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited through an authentication bypass weakness in the web component of Ivanti Connect Secure and Ivanti Policy Secure. Remote attackers leverage this vulnerability to gain unauthorized access by bypassing control checks. ","confidence":"high"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited through an authentication bypass weakness in the web component of Ivanti Connect Secure and Ivanti Policy Secure. Remote attackers leverage this vulnerability to gain unauthorized access by bypassing control checks. ","confidence":"high"},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev","report-passage"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass; keyword query KW:T1505.003:1","mappingType":"secondary_impact","evidence":[{"reportId":"SRC-69c48a8dfa48e4fbb916","quote":"Following the successful exploitation of CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection), UNC5221 leveraged multiple custom malware families including the ZIPLINE passive backdoor, THINSPOOL dropper, LIGHTWIRE web shell, and WARPWIRE credential harvester.","start":1830,"end":2115}],"comment":"This vulnerability is exploited through an authentication bypass weakness in the web component of Ivanti Connect Secure and Ivanti Policy Secure. Remote attackers leverage this vulnerability to gain unauthorized access by bypassing control checks. ","confidence":"high"},{"id":"T1555","name":"Credentials from Password Stores","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited through an authentication bypass weakness in the web component of Ivanti Connect Secure and Ivanti Policy Secure. Remote attackers leverage this vulnerability to gain unauthorized access by bypassing control checks. ","confidence":"high"}],"reports":[{"id":"SRC-69ce9610bb628b0a6cad","title":"Infiltrating Defenses: Abusing VMware in MITRE’s Cyber Intrusion","publisher":"ctid.mitre.org","url":"https://ctid.mitre.org/blog/2024/05/22/infiltrating-defenses-abusing-vmware-in-mitres-cyber-intrusion/","date":"2024-05-22","mentions":[{"quote":"Adversary compromised MITRE’s prototypingnetwork through a pair of zero-day vulnerabilities in Ivanti Connect Secure (CVE-2023–46805 & CVE-2024–21887)","start":2881,"end":3031}]},{"id":"SRC-b29db5c20a3fa9923618","title":"Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN","publisher":"volexity.com","url":"https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/","date":"2024-01-10","mentions":[{"quote":"CVE-2023-46805 – an authentication-bypass vulnerability with a CVSS score of 8.2","start":2582,"end":2662}]},{"id":"SRC-8d5517bedbda024608fa","title":"Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a","date":null,"mentions":[{"quote":"CVE-2024-21887 - Ivanti Connect Secure and Ivanti Policy Secure web-component command injection vulnerability, commonly chained after CVE-2023-46805 (authentication bypass)","start":8146,"end":8318},{"quote":"Command injection vulnerability, commonly chained after CVE-2023-46805 (authentication bypass)","start":84298,"end":84392}]},{"id":"SRC-69c48a8dfa48e4fbb916","title":"Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation","publisher":"cloud.google.com","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":null,"mentions":[{"quote":"UNC5221 is a suspected China-nexus espionage actor that previously exploited two vulnerabilities CVE-2023-46805 and CVE-2024-21887 that impacted Ivanti Connect Secure VPN appliances as early as December 2023.","start":1621,"end":1829},{"quote":"Following the successful exploitation of CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection), UNC5221 leveraged multiple custom malware families including the ZIPLINE passive backdoor, THINSPOOL dropper, LIGHTWIRE web shell, and WARPWIRE credential harvester.","start":1830,"end":2115},{"quote":"Apart from CVE-2023-46805 and CVE-2024-21887, Mandiant has previously observed UNC5221 conducting zero day exploitation of CVE-2023-4966, impacting NetScaler ADC and NetScaler Gateway appliances.","start":25766,"end":25961},{"quote":"10, 2024, disclosure of CVE-2023-46805 and CVE-2024-21887, Mandiant observed widespread exploitation by UNC5221 targeting Ivanti Connect Secure appliances across a wide range of countries and verticals.","start":26358,"end":26560}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-50971","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-50971","exploited":true,"exploitedSince":"2024-01-10","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":9,"skipped":0,"earliest":"2024-01-14","earliestUrl":"https://github.com/yoryio/CVE-2023-46805","repos":[{"name":"duy-31/CVE-2023-46805_CVE-2024-21887","url":"https://github.com/duy-31/CVE-2023-46805_CVE-2024-21887","stars":23,"created":"2024-01-16"},{"name":"Chocapikk/CVE-2023-46805","url":"https://github.com/Chocapikk/CVE-2023-46805","stars":14,"created":"2024-01-19"},{"name":"seajaysec/Ivanti-Connect-Around-Scan","url":"https://github.com/seajaysec/Ivanti-Connect-Around-Scan","stars":12,"created":"2024-01-19"},{"name":"yoryio/CVE-2023-46805","url":"https://github.com/yoryio/CVE-2023-46805","stars":10,"created":"2024-01-14"},{"name":"Hexastrike/Ivanti-Connect-Secure-Logs-Parser","url":"https://github.com/Hexastrike/Ivanti-Connect-Secure-Logs-Parser","stars":6,"created":"2025-01-19"}]},"metasploit":[{"name":"Ivanti Connect Secure Unauthenticated Remote Code Execution","module":"exploit/linux/http/ivanti_connect_secure_rce_cve_2023_46805","type":"exploit","disclosureDate":"2024-01-10","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2023_46805.rb"}],"nuclei":[{"id":"CVE-2023-46805","name":"Ivanti ICS - Authentication Bypass","severity":"high","path":"http/cves/2023/CVE-2023-46805.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-46805.yaml"}],"first":{"date":"2024-01-10","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2023_46805.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1078"],"provenance":"source"},{"stage":"secondary","techniques":["T1505.003","T1555"],"provenance":"source"}],"timeline":[{"date":"2024-01-10","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2024-01-14","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2023_46805.rb","provenance":"source"},{"date":"2024-01-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2024-01-10","kind":"report","label":"Named in volexity.com: Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN","url":"https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/","provenance":"machine"},{"date":"2024-01-10","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-01-10","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-50971","provenance":"source"},{"date":"2024-01-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46805","provenance":"source"},{"date":"2024-05-22","kind":"report","label":"Named in ctid.mitre.org: Infiltrating Defenses: Abusing VMware in MITRE’s Cyber Intrusion","url":"https://ctid.mitre.org/blog/2024/05/22/infiltrating-defenses-abusing-vmware-in-mitres-cyber-intrusion/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":87.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1025 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9998"},{"name":"Named in threat reports","points":8.98,"detail":"4 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 9 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.74,"detail":"base score 8.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}