CVE-2023-46805Ivanti Connect Secure authentication bypass
What broke
Ivanti Connect Secure and Policy Secure (the Pulse Secure VPN descendants) failed to authenticate a request that should have required a session. Chained with CVE-2024-21887 (command injection) this became unauthenticated RCE. Public in January 2024, assigned a 2023 ID. CISA KEV. The later SAML SSRF was the door after this pair was patched.
Why it matters
A SSL VPN is the front door of workforce identity. "Authentication bypass on the VPN" is the whole job of the box failing. Chinese and other state actors used the chain. Identity teams who do not own the VPN still own the fallout: every session, every AD bind the appliance held.
What to do
- Confirm the January 2024 Ivanti builds. If you were internet-facing when this dropped, rebuild. Integrity-check tools missed some implants.
- Rotate LDAP/RADIUS credentials the appliance used.
- Hunt with CISA's ICSA and Mandiant's Integrity Checker notes, not only "we patched."
After you patch
Edge appliances sit outside the estate and hold credentials into it, which is why this class keeps producing multi-victim campaigns.
- Revoke all sessions on the appliance, then rotate the directory or LDAP service account it uses for authentication.
- Rotate certificates and any stored integration credentials, since configuration stores on these devices are a routine post-exploitation target.
- Hunt for authenticated sessions with no matching interactive login, and for logins from ASNs that had never appeared before the disclosure date.
- Check downstream: anything the appliance could reach or authenticate to is in scope, including SSO-connected applications.
Sources
- NVD: CVE-2023-46805
- Ivanti KB for CVE-2023-46805 / CVE-2024-21887
- CISA KEV
Related identity CVEs
In the Identity Breach Database
Breaches in our database where this vulnerability was exploited.
- MITRE NERVE network breached via Ivanti zero-days and session hijacking 2024 · Identity infrastructure vulnerability
Related on Start with Identity
- CVEIvanti Connect Secure authentication bypass by spoofed header, exploited as a zero-day
One crafted X-DSCGI-PATH header lets an unauthenticated attacker past Ivanti Connect Secure's login and into command execution. Exploited since early October 20
- CVEIvanti Connect Secure root escalation, the last link in the UTA0576 chain
The privilege escalation UTA0576 chained with CVE-2026-104935 to reach root on fully patched Ivanti Connect Secure VPNs, then mine Active Directory. Patched Oct
- CVEIvanti Sentry authentication bypass
Ivanti Sentry (MobileIron Sentry) skipped authentication on an administrative API. CISA KEV. August 2023. The gateway in front of EPMM had its own unlocked door
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the