CVE-2023-46805: Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
Published Jan 10, 2024
·Updated
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
Other sources
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability.
— CISA
Affected Software
82 affected components
Ivanti Connect Secure and Policy Secure
Ivanti Connect Secure=9.0
Ivanti Connect Secure=9.1-r1
Ivanti Connect Secure=9.1-r10
Ivanti Connect Secure=9.1-r11
Ivanti Connect Secure=9.1-r11.3
Ivanti Connect Secure=9.1-r11.4
Ivanti Connect Secure=9.1-r11.5
Ivanti Connect Secure=9.1-r12
Ivanti Connect Secure=9.1-r12.1
Ivanti Connect Secure=9.1-r13
Ivanti Connect Secure=9.1-r13.1
Ivanti Connect Secure=9.1-r14
Ivanti Connect Secure=9.1-r15
Ivanti Connect Secure=9.1-r15.2
Ivanti Connect Secure=9.1-r16
Ivanti Connect Secure=9.1-r16.1
Ivanti Connect Secure=9.1-r17
Ivanti Connect Secure=9.1-r17.1
Ivanti Connect Secure=9.1-r18
Ivanti Connect Secure=9.1-r2
Ivanti Connect Secure=9.1-r3
Ivanti Connect Secure=9.1-r4
Ivanti Connect Secure=9.1-r4.1
Ivanti Connect Secure=9.1-r4.2
Ivanti Connect Secure=9.1-r4.3
Ivanti Connect Secure=9.1-r5
Ivanti Connect Secure=9.1-r6
Ivanti Connect Secure=9.1-r7
Ivanti Connect Secure=9.1-r8
Ivanti Connect Secure=9.1-r8.1
Ivanti Connect Secure=9.1-r8.2
Ivanti Connect Secure=9.1-r9
Ivanti Connect Secure=9.1-r9.1
Ivanti Connect Secure=22.1-r1
Ivanti Connect Secure=22.1-r6
Ivanti Connect Secure=22.2
Ivanti Connect Secure=22.2-r1
Ivanti Connect Secure=22.3-r1
Ivanti Connect Secure=22.4-r1
Ivanti Connect Secure=22.4-r2.1
Ivanti Connect Secure=22.5-r2.1
Ivanti Connect Secure=22.6
Ivanti Connect Secure=22.6-r1
Ivanti Connect Secure=22.6-r2
Ivanti Policy Secure=9.0
Ivanti Policy Secure=9.1-r1
Ivanti Policy Secure=9.1-r10
Ivanti Policy Secure=9.1-r11
Ivanti Policy Secure=9.1-r12
Ivanti Policy Secure=9.1-r13
Ivanti Policy Secure=9.1-r13.1
Ivanti Policy Secure=9.1-r14
Ivanti Policy Secure=9.1-r15
Ivanti Policy Secure=9.1-r16
Ivanti Policy Secure=9.1-r17
Ivanti Policy Secure=9.1-r18
Ivanti Policy Secure=9.1-r2
Ivanti Policy Secure=9.1-r3
Ivanti Policy Secure=9.1-r3.1
Ivanti Policy Secure=9.1-r4
Ivanti Policy Secure=9.1-r4.1
Ivanti Policy Secure=9.1-r4.2
Ivanti Policy Secure=9.1-r5
Ivanti Policy Secure=9.1-r6
Ivanti Policy Secure=9.1-r7
Ivanti Policy Secure=9.1-r8
Ivanti Policy Secure=9.1-r8.1
Ivanti Policy Secure=9.1-r8.2
Ivanti Policy Secure=9.1-r9
Ivanti Policy Secure=22.1-r1
Ivanti Policy Secure=22.1-r6
Ivanti Policy Secure=22.2-r1
Ivanti Policy Secure=22.2-r3
Ivanti Policy Secure=22.3-r1
Ivanti Policy Secure=22.3-r3
Ivanti Policy Secure=22.4-r1
Ivanti Policy Secure=22.4-r2
Ivanti Policy Secure=22.4-r2.1
Ivanti Policy Secure=22.5-r1
Ivanti Policy Secure=22.5-r2.1
Ivanti Policy Secure=22.6-r1
Event History
Jan 10, 2024
CVE Published
via CISA·12:00 AM
Known Exploited
via CISA·12:00 AM
Known Ransomware
via CISA·12:00 AM
Data Sourced
via CISA·12:00 AM
RemedyDescriptionAffected Software
News Published
06:53 PM
Jan 12, 2024
News Published
03:30 PM
CVE Published
via MITRE·05:02 PM
Data Sourced
via MITRE·05:02 PM
DescriptionSeverity
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Jan 13, 2024
News Published
via The Register·02:20 AM
Jan 16, 2024
News Published
via BleepingComputer·01:05 AM
Jan 18, 2024
News Published
via BleepingComputer·08:51 PM
News Published
via BleepingComputer·08:53 PM
Jan 19, 2024
News Published
via BleepingComputer·07:25 PM
Jan 21, 2024
News Published
via The Register·02:25 AM
Jan 22, 2024
News Published
via BleepingComputer·06:24 PM
Jan 31, 2024
News Published
via BleepingComputer·01:41 PM
Feb 1, 2024
News Published
via BleepingComputer·01:49 PM
Feb 5, 2024
News Published
via BleepingComputer·03:55 PM
News Published
via The Register·08:45 PM
Feb 8, 2024
News Published
via BleepingComputer·07:45 PM
Feb 15, 2024
News Published
via BleepingComputer·03:30 PM
Feb 29, 2024
News Published
via BleepingComputer·08:35 PM
Mar 9, 2024
News Published
via BleepingComputer·03:08 PM
Mar 20, 2024
News Published
via BleepingComputer·05:08 PM
Apr 3, 2024
News Published
via BleepingComputer·05:29 PM
Apr 4, 2024
News Published
via The Register·03:07 PM
Apr 5, 2024
News Published
via BleepingComputer·05:40 PM
Apr 19, 2024
News Published
via BleepingComputer·07:02 PM
Jun 24, 2024
News Published
via BleepingComputer·08:53 PM
Jun 25, 2024
News Published
via The Register·01:45 PM
Aug 13, 2024
News Published
via BleepingComputer·03:27 PM
Sep 10, 2024
News Published
via BleepingComputer·07:28 PM
Nov 27, 2024
News Published
via The Register·11:44 PM
Jan 23, 2025
News Published
via The Register·11:30 PM
Apr 3, 2025
News Published
via BleepingComputer·05:43 PM
News Published
via The Register·07:14 PM
Sep 24, 2025
News Published
via The Register·02:17 PM
Apr 6, 2026
News Published
via BleepingComputer·04:56 PM
Jun 18, 2026
News Published
via Dark Reading·07:09 PM
News Published
via Dark Reading·07:33 PM
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
1
What is the severity of CVE-2023-46805?
CVE-2023-46805 is rated as critical due to its potential for authentication bypass, allowing unrestricted access to sensitive information.
2
What versions are affected by CVE-2023-46805?
CVE-2023-46805 affects Ivanti Connect Secure and Ivanti Policy Secure versions 9.x and 22.x.
3
How do I fix CVE-2023-46805?
To remediate CVE-2023-46805, users should upgrade to the latest patched versions of Ivanti Connect Secure and Ivanti Policy Secure.
4
What type of vulnerability is CVE-2023-46805?
CVE-2023-46805 is an authentication bypass vulnerability in the web component of Ivanti's software.
5
Who can exploit CVE-2023-46805?
CVE-2023-46805 can be exploited by remote attackers without requiring authentication, making it particularly dangerous.