CVE-2023-46805

Ivanti Connect Secure (ICS, formerly Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass (CWE-287) in the web component that allows an attacker to access restricted resources by bypassing control checks without valid credentials. The flaw is triggered through the exposed web interface of the gateway, and it is most dangerous when chained with CVE-2024-21887, a command injection vulnerability in the same component, which turns the bypass into unauthenticated arbitrary command execution on the appliance. An attacker gains access to protected resources and, via the chained command injection, the ability to run commands on the gateway — the pattern observed in the January 2024 exploitation wave that led to follow-on compromise, including known ransomware use. Affected organizations are those running Ivanti Connect Secure or Policy Secure gateways, which are typically deployed as internet-facing VPN concentrators at the network edge. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2024-01-10 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days (100th percentile); no CVSS score is available yet and no public PoC is known.

What to do: Apply Ivanti's mitigations or patched builds per the vendor's instructions immediately, or discontinue use of the product if mitigations are unavailable, as CISA's KEV required action states, and remediate the companion command injection flaw CVE-2024-21887 on the same gateways. Because exploitation is confirmed in the wild with known ransomware use, treat any long-running appliance as potentially compromised: check it for signs of compromise per vendor guidance and rotate credentials, sessions, and any secrets stored on or reachable through the VPN.