CVE-2023-46805: Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability

CVE-2023-46805 is an authentication bypass vulnerability affecting Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure gateways. It allows an unauthenticated attacker to reach restricted resources on the web component by bypassing control checks. The flaw matters because these products commonly sit at the network edge as VPN and access gateways; successful abuse can give attackers a foothold that has been chained with a separate command-injection issue (CVE-2024-21887) and has been used in ransomware campaigns. Confirm exact impact and fixed releases against the vendor advisory.

How it works

The weakness is classified as CWE-287 (Improper Authentication). In the web component of the affected gateways, authentication and authorization checks can be bypassed, letting an attacker obtain access to resources that should require valid credentials or session state. Public detail on the precise request path or parameter is limited; defenders should treat any unauthenticated request that reaches restricted administrative or API endpoints as potentially abusive. Once the bypass is achieved, the same session or context can be used to trigger further flaws such as the command-injection vulnerability CVE-2024-21887, enabling code execution on the appliance. No exploit code or step-by-step mechanics are provided here; always validate behavior against the official vendor write-up.

Am I affected? How to find it in your systems

Ivanti Connect Secure and Policy Secure typically run as physical or virtual appliances that terminate remote-access VPN, SSL VPN, or policy-enforcement traffic. They appear in network inventories as edge devices, often with public-facing HTTPS listeners and management interfaces. To locate them:

• Query asset-management, CMDB, or vulnerability-scanner results for hostnames, banners, or certificates containing “Ivanti,” “Pulse Connect Secure,” “PCS,” or “Policy Secure.”
• Inspect firewall and load-balancer rules that forward traffic to known Ivanti management or portal ports.
• Review appliance version strings via the local console or authenticated management UI; compare them with the versions listed as vulnerable in the vendor advisory (exact numbers are not restated here).
• Look for unexpected unauthenticated access to restricted web paths in access logs, reverse-proxy logs, or WAF alerts. Spikes in 200 responses to administrative endpoints from external sources, or subsequent command-injection indicators, may signal exploitation.

If the product is present and the version or configuration matches the advisory, treat the system as affected until proven otherwise.

How to remediate

The primary action is to apply the vendor-supplied update or mitigation package for CVE-2023-46805 as soon as it is available and tested in your environment. CISA directs organizations to follow the vendor’s instructions or to discontinue use of the product if mitigations cannot be applied. After patching:

• Reboot or reload the appliance according to vendor guidance so the new code is active.
• Verify the version string and re-run any vendor integrity or integrity-check tools.
• Rotate any credentials, certificates, or API keys that may have been exposed while the device was vulnerable.
• Harden the remaining surface: restrict management interfaces to jump hosts or management VLANs, enforce multi-factor authentication for all administrative accounts, and disable unused web features or portals.

Document the change and schedule a follow-up scan to confirm the vulnerability is no longer reported.

If you can't patch immediately

Until the official update can be installed, reduce exposure with compensating controls:

• Segment the gateway so that only necessary client subnets can reach the portal; block direct internet access to management ports.
• Place a web application firewall or reverse proxy in front of the appliance and enable virtual-patching rules that drop or challenge unauthenticated requests to restricted paths (confirm signatures against the vendor or CISA guidance).
• Temporarily disable any non-essential web components or features that the advisory identifies as part of the attack surface.
• Increase logging and monitoring: forward appliance logs to a SIEM, alert on anomalous authentication bypass patterns or subsequent command-injection attempts, and watch for ransomware-related indicators such as unusual encryption activity or lateral-movement traffic originating from the gateway.
• If risk remains unacceptable, take the device offline and provide alternative remote-access methods until a patched version is ready.

If your data may have been exposed

This vulnerability has been actively exploited and is known to have been used in ransomware operations. If your Ivanti gateways were internet-facing and unpatched during the period of known exploitation, assume possible compromise of credentials, session data, or internal network access. Conduct a full incident-response review, rotate secrets, and examine logs for post-exploitation activity. Separately, individuals can run a free exposure scan of their email addresses against known breach data sets to determine whether personal credentials have appeared in prior incidents.