Vulnerabilities/Ivanti/CVE-2023-46805
CVE-2023-46805: Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC
Exploitation confirmedRansomware use knownFix: Unknown
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability.
Recommended action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date 22 Jan 2024 · CWE-287
Am I affected?
| Product | Affected versions | Fixed in |
|---|---|---|
| ICS | 9.1R18 to 9.1R18 | Unknown |
| ICS | 22.6R2 to 22.6R2 | Unknown |
| IPS | 9.1R18 to 9.1R18 | Unknown |
| IPS | 22.6R1 to 22.6R1 | Unknown |
No source states a fixed version. Check the vendor advisory below.
Before you patch
Restart
See vendor guidance.Known issues
Check release notes.Verification
Confirm installed version.Timeline
- 10 Jan 2024 · Added to CISA KEV
- 22 Jan 2024 · CISA due date
Sources checked
| CISA KEV | 30 Oct 2026, 12:10 UTC |
| CVE List v5 | 30 Oct 2026, 12:10 UTC |
| NVD | 30 Oct 2026, 12:10 UTC |
| FIRST EPSS | 30 Oct 2026, 12:11 UTC |
Data from CISA, MITRE, NVD and FIRST. Sources and licences.