Policy Secure
CVE-2023-46805
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2021 - Identification and Authentication Failures
ASVS 5.0
V2 - Authentication Authentication mechanism strength, credential management
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Critical risk (CVSS 8.2, EPSS 94.4%). Mass exploitation in January 2024 compromised thousands of organizations worldwide. CISA issued an emergency directive requiring all federal agencies to disconnect Ivanti products. Multiple Chinese APT groups (UNC5221, UNC5325) were among the earliest exploiters. |
| Exploit ScenarioDerived | An attacker bypasses authentication on the Ivanti web interface, then chains the command injection (CVE-2024-21887) to execute commands as root on the VPN appliance. Custom web shells (LIGHTWIRE, WIREFIRE) are deployed for persistent access. VPN credentials and session tokens are harvested. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
Ivanti Connect Secure and Policy Secure contain an authentication bypass in the web component allowing unauthenticated access to restricted resources, chained with CVE-2024-21887 for unauthenticated RCE in massive exploitation campaigns starting January 2024.
Earlier versions of this analysis (1)
An authentication bypass in Ivanti ICS/Policy Secure's web component allows unauthenticated access to restricted resources. This was the first link in the devastating Ivanti exploitation chain of January 2024 (alongside CVE-2024-21887).
RemediationAI
Apply Ivanti patches. CISA recommends factory reset before patching due to persistent implant concerns. Rotate all credentials. Run Ivanti's Integrity Checker Tool. Consider migrating to alternative VPN solutions.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CWE-287 authentication bypass allows attackers to circumvent web component access controls through crafted requests. Chained with CVE-2024-21887 (command injection), this enables unauthenticated remote code execution on Ivanti VPN appliances.
Know when Policy Secure gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
Executive ViewAI
CVE-2023-46805 presents notable security risk, a improper authentication vulnerability rated CVSS 8.2. Attackers could bypass security controls to gain unauthorized access to protected resources and sensitive data. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls; (2) Enable MFA where possible; (3) Monitor authentication logs for anomalous access.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)NVD
More in Policy Secure
View allIvanti Connect Secure and Policy Secure contain an authenticated command injection in web components allowing administra
Ivanti Connect Secure and Policy Secure contain an SSRF vulnerability in the SAML component allowing unauthenticated acc
Ivanti Connect Secure, Policy Secure, and Neurons for ZTA contain a stack-based buffer overflow allowing unauthenticated
Remote code execution in Ivanti Connect Secure (before 22.7R2.6), Ivanti Policy Secure (before 22.7R1.4), and Ivanti ZTA
Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Se
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1R
A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an
A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Se
A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform
Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows
A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could
GitHub PoC
Exploit-DB