CVE-2023-46805

What it actually does

CVE-2023-46805 is a network-accessible authentication bypass in the web component of Ivanti Connect Secure and Ivanti Policy Secure. A remote unauthenticated attacker can craft requests that bypass access-control checks and reach restricted appliance resources. On its own, the flaw can expose sensitive administrative or configuration data and allow limited unauthorized actions; in real-world campaigns it has commonly been chained with command-injection vulnerabilities, especially CVE-2024-21887, to achieve remote code execution, deploy web shells, steal credentials, and maintain persistence on the appliance.

Why it matters to the business

Affected Ivanti VPN and access-control appliances sit at the network perimeter and often protect access to internal systems, so compromise can give attackers a high-value foothold into the organization. This vulnerability is in CISA KEV, has extremely high EPSS, is known to be exploited in the wild, has been used in ransomware-related activity, and the CISA remediation deadline of 2024-01-22 has passed, making unremediated systems a priority exposure. Business consequences include unauthorized remote access, credential theft, data exposure, disruption of secure remote access, lateral movement into internal networks, incident-response costs, and potential ransomware deployment.

How an attack unfolds

An attacker scans the internet for exposed Ivanti Connect Secure or Ivanti Policy Secure appliances. After identifying a vulnerable target, the attacker sends crafted unauthenticated HTTP requests to protected API or administrative paths in a way that bypasses the product’s normal authorization checks. The attacker then accesses restricted resources and, in many observed intrusions, chains the bypass with a second vulnerability such as CVE-2024-21887 to execute operating-system commands. Post-exploitation activity may include collecting appliance configuration and session data, stealing credentials or tokens, creating or modifying files, deploying web shells, tunneling traffic through the appliance, establishing persistence, and using the appliance as a launch point for internal reconnaissance or ransomware operations.

How to fix it

Apply the current Ivanti vendor fix for the affected Connect Secure or Policy Secure release, or upgrade to a supported fixed release when a direct patch is not available. If immediate patching is not possible, apply Ivanti’s official mitigation for the exact product and version, restrict management and user-facing access to trusted networks where feasible, and monitor aggressively until patched. Because this vulnerability is actively exploited, remediation should not stop at patching: run Ivanti’s external and internal Integrity Checker Tool, preserve forensic artifacts before rebuilding if compromise is suspected, rotate local and directory-integrated credentials that may have traversed the appliance, review and reissue certificates or keys if exposed, and consider factory reset or clean rebuild for appliances with integrity-check failures or credible compromise evidence.

How to confirm the fix worked

Confirm the appliance is running a vendor-supported fixed release or has the official Ivanti mitigation applied for its exact product branch. Validate using the vendor-recommended Integrity Checker Tool and confirm there are no unexpected modified files, unexpected web content, unauthorized local users, unexplained configuration changes, or suspicious scheduled jobs. From a network perspective, verify that unauthenticated requests to protected API or administrative endpoints are rejected and that requests containing path traversal patterns such as '../' cannot reach restricted resources. Re-scan internet-facing assets to ensure all exposed Ivanti Connect Secure and Policy Secure appliances are accounted for and patched or isolated.

Typical attack path

1. Identify internet-facing Ivanti Connect Secure or Ivanti Policy Secure appliances through scanning, certificate metadata, banners, or known URL paths.
2. Send crafted unauthenticated HTTP requests that bypass web-component access-control checks.
3. Access restricted appliance endpoints or administrative resources without valid credentials.
4. Chain the authentication bypass with another vulnerability, commonly command injection, to execute commands on the appliance.
5. Collect configuration files, credentials, session artifacts, certificates, or other sensitive appliance data.
6. Deploy persistence such as web shells, modified scripts, scheduled tasks, or unauthorized local accounts where possible.
7. Use the compromised appliance for internal reconnaissance, credential reuse, lateral movement, data theft, cryptomining, or ransomware staging.

How to detect it

Review Ivanti appliance web access logs, admin/event logs, VPN session logs, authentication logs, configuration-change logs, reverse-proxy logs, firewall logs, DNS logs, EDR telemetry where available, and Integrity Checker Tool results. Look for unauthenticated requests to protected REST or administrative endpoints, URL paths containing traversal sequences such as '../' or encoded equivalents, requests to TOTP or maintenance API paths from unfamiliar sources, and sequences where an unauthenticated request is followed by command-execution behavior or new files on the appliance. Hunt for signs of chained exploitation: webserver processes spawning shell utilities, curl/wget/python/perl/bash execution, unexpected outbound connections from the appliance, creation or modification of web-accessible files, suspicious archive/export activity, unexplained admin logins, new local users, changed authentication settings, or anomalous VPN sessions. Because threat actors have included espionage, cryptomining, financially motivated, and ransomware-linked campaigns, also review for post-compromise behavior such as internal scanning, credential reuse, data staging, tunneling, and persistence mechanisms.

• /api/v1/totp/user-backup-code/../../
• /api/v1/totp/user-backup-code/..%2f..%2f
• /api/v1/totp/user-backup-code/%2e%2e/%2e%2e/
• /system/maintenance/archiving/cloud-server-test-connection
• cloud-server-test-connection
• user-backup-code/../../
• ../system/maintenance/
• ..%2f..%2fsystem%2fmaintenance%2f
• GET /api/v1/totp/user-backup-code/../../
• POST /api/v1/totp/user-backup-code/../../
• POST /api/v1/totp/user-backup-code/../../system/maintenance/archiving/cloud-server-test-connection
• GET /api/v1/totp/user-backup-code/../../license/keys-status
• /license/keys-status
• bash -c
• /bin/sh -c
• curl http://
• wget http://
• python -c
• perl -e

What your security team should do

• Treat any unpatched internet-facing Ivanti Connect Secure or Policy Secure appliance as potentially compromised due to active exploitation, KEV status, ransomware use, and the overdue remediation deadline.
• Immediately patch or upgrade affected appliances; if patching cannot be completed promptly, apply Ivanti’s official mitigation and restrict access with network controls.
• Run Ivanti Integrity Checker Tool and preserve results, logs, and disk artifacts before making destructive changes if compromise is suspected.
• Hunt for exploitation attempts using web, appliance, VPN, authentication, EDR, DNS, proxy, and firewall logs, focusing on unauthenticated requests to restricted API paths and path traversal sequences.
• Investigate for chained exploitation, especially command execution, web shell deployment, unexpected outbound connections, configuration exports, credential theft, and suspicious administrative changes.
• Rotate credentials, API keys, service account passwords, SAML/OIDC secrets, certificates, and other sensitive material that may have been stored on or passed through compromised appliances.
• If integrity checks fail or exploitation is confirmed, rebuild from trusted media or factory reset according to vendor guidance rather than relying only on patching.
• Add perimeter detection and alerting for suspicious Ivanti API paths, path traversal strings, unexpected appliance egress, and webserver child processes spawning shells or scripting interpreters.