8.2 High Exploited · ransomware

CVE-2023-46805 Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Ransomware campaigns Known to be used

Weakness CWE-287

Description

An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.

Affected products and versions

Product	Affected versions	Fixed in
ICS	22.6R2	No fix stated
ICS	9.1R18	No fix stated
IPS	22.6R1	No fix stated
IPS	9.1R18	No fix stated

References

forums.ivanti.com forums.ivanti.com
packetstormsecurity.com packetstormsecurity.com

Timeline

Published January 12, 2024
Added to the KEV catalogue January 10, 2024
Last modified October 1, 2026

The 5 CVEs of ICS →

CVE-2024-22024 An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy… 8.3 High CVE-2024-21893 Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability 8.2 High CVE-2024-21888 A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure… 8.8 High CVE-2024-21887 Ivanti Connect Secure and Policy Secure Command Injection Vulnerability 9.1 Critical

Track this CVE