Join our Newsletter — 33% off our NHI Course

CVE-2023-46805 (Ivanti Connect Secure and Policy Secure Authentication Bypass)

CVE-2023-46805 is an authentication bypass vulnerability in Ivanti Connect Secure and Policy Secure. CISA added it to the Known Exploited Vulnerabilities catalogue on 10 January 2024, which means attackers have used it in real attacks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability.

What this vulnerability means in practice

CVE-2023-46805 is dangerous because it removes the normal trust boundary around authentication on an internet-facing remote access appliance. When an attacker can bypass login on a VPN or secure gateway, they may reach internal resources that were assumed to be protected by the appliance’s access controls.

This is why the issue matters beyond the product itself: authentication bypass on an edge system can become an initial access path into broader identity, application, and network trust relationships. For authoritative record details and patch guidance, readers should consult the CVE Program and the NIST National Vulnerability Database.

Why this kind of bypass is high impact

An authentication bypass in a remote access product is especially serious because it can defeat the first control that stands between the internet and private systems. If the appliance is used for employee, contractor, or administrative access, a successful bypass can expose credentials, sessions, and internal applications that were never meant to be directly reachable.

In this case, the primary danger is not just unauthorized entry, but the way that entry can be chained with other flaws. The primary definition states that this vulnerability can be used with CVE-2024-21887, so defenders should treat the pair as a combined exposure rather than as isolated bugs. That pattern is common in edge appliance compromises, where one flaw opens the door and a second flaw expands control.

How organisations assess exposure and reduce blast radius

Exposure checking starts with asset inventory: identify every Ivanti Connect Secure and Policy Secure instance, determine whether it is internet-facing, and confirm whether it is still in active use. If an appliance is reachable from the public internet, assume it deserves immediate review even if no alert has fired.

Review vendor advisories for exact version and remediation instructions, then compare them with your deployment records rather than relying on memory. For temporary risk reduction, restrict exposure at the network edge, limit who can reach the appliance, and assume that any account or session that traversed the device may need closer scrutiny.

The Ivanti Connect Secure exploitation 2024 analysis shows why this matters: exploitation of edge VPN appliances has been associated with credential theft, service-account exposure, and session hijacking. For broader remote-access hardening, the Remote Access Identity Guide explains why MFA, ZTNA, and retirement of dormant VPN access reduce dependence on a single perimeter control.

Detection, remediation, and compromise review

Detection should focus on signs that the appliance was used as an access foothold, not only on the vulnerability itself. Review authentication logs, unusual administrative activity, new sessions, unexpected outbound connections, and any evidence of follow-on actions after the likely compromise window.

If exploitation is suspected, patching alone is not enough. Treat the appliance as a potential source of stolen credentials or session material, and review adjacent systems for lateral movement. The right post-patch question is not only whether the device is fixed, but whether attackers already used it to reach other identity-bearing assets.

The Vulnerability Management Guide is not the right source here because the URL is not present in the approved block, so this page instead relies on the vendor advisory process and the KEV catalogue for remediation prioritisation.

Risk and Threat Considerations

This vulnerability is risky because a bypass on a remote access appliance can turn a trusted entry point into an attacker-controlled bridge into the environment. In practice, that can enable credential theft, session reuse, and movement toward internal systems that rely on the VPN boundary for protection.

Failure mechanism: The attacker defeats authentication on the appliance, then uses that trusted position to access internal services or chain the bypass with a second flaw for deeper compromise.

Impact: Organisations can lose the integrity of remote access, expose internal applications, and inherit a wider incident response problem that includes identity material, sessions, and downstream systems.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework Control / Reference Relevance
NIST SP 800-53 Rev 5 IA-2 — Identification and Authentication (Organizational Users) Authentication bypass directly defeats organizational user login controls on remote access systems.
IA-9 — Service Identification and Authentication Compromised edge appliances can expose service-to-service trust and machine credentials.
AU-6 — Audit Record Review, Analysis, and Reporting Detection depends on reviewing appliance and downstream authentication activity for abuse.
Recommendation — Enforce strong user authentication and invalidate any sessions that may have crossed the appliance. Require mutual authentication for service connections and rotate credentials if the device was exploited. Correlate appliance logs with downstream access events to identify compromise and lateral movement.
CIS Controls v8 CIS-5 — Account Management Compromised remote access can expose accounts that must be reviewed, disabled, or rotated.
Recommendation — Review exposed accounts and revoke any access that may have been used through the appliance.

Practitioner Guidance

Why practitioners should care: Authentication bypass on an edge appliance is an incident-class issue, not a routine patch item, because it can invalidate assumptions about who reached the network and what they touched. Treat the appliance as part of the identity boundary when triaging exposure and response.

What to watch for: Focus on public-facing instances, anomalous logins, new admin actions, and any evidence that the device was used before remediation. If you find signs of exploitation, expand review to credentials, sessions, and service accounts that may have traversed the appliance.