How do you patch or mitigate CVE-2023-46805 (Ivanti Connect Secure and Policy Secure Authentication Bypass)?

CISA’s required action for CVE-2023-46805 is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. In practice, find every instance of Ivanti Connect Secure and Policy Secure in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service.

What changes when you treat CVE-2023-46805 as a patch-or-mitigate problem?

This is not a “wait for the next maintenance window” issue. For an authentication bypass on an edge remote-access product, the practical question is whether you can still trust the appliance to enforce login at all. If the answer is uncertain, assume exposure first, then validate whether the vendor update or mitigation is actually in place and effective.

The fastest useful triage is inventory, exposure, and control state: identify every Ivanti Connect Secure and Policy Secure instance, confirm whether it is reachable from untrusted networks, and verify whether the product is already on the vendor’s documented fix or mitigation path. If you cannot confirm that quickly, treat the device as security-relevant infrastructure that may need to be isolated before deeper investigation.

When patching is available, the goal is not just installation, but removal of the bypass condition. For internet-facing appliances, that usually means updating the product, confirming the documented mitigation is active, and validating that remote authentication behaves normally after change. If the appliance cannot be safely remediated, the safer decision is to remove it from exposure or discontinue use, rather than keep an untrusted access path online.

What should you do if the device cannot be patched immediately?

Delay is sometimes unavoidable, but the compensating action must reduce the attack surface in a way that matches the role of the product. For a remote-access gateway, that means shrinking or removing internet reachability, tightening perimeter controls around management and user access, and watching for any sign that the appliance has already been used as an initial access point.

Use that interim period to determine whether the bypass was only theoretical in your environment or whether the appliance has been actively abused. Look for unusual logins, new sessions, anomalous administrative changes, unexpected configuration drift, and signs that credentials or session material may have been exposed through the device. If the appliance was externally exposed during the vulnerable period, assume the blast radius may extend beyond the appliance itself.

For remote-access systems, the second-order risk is that one bypass leads to a broader trust failure. A compromised gateway can become the launch point for lateral movement, credential theft, or session abuse, so the mitigation plan should include revocation or rotation where exposure is plausible, not only software change.

For operational context and replacement planning, the VPN Security Guide is a useful reference for hardening, patching, and deciding when a remote-access appliance should be retired rather than preserved.

How do you confirm you are actually done?

Completion is not “the patch was installed.” It is “the bypass path is no longer reachable, and there is no evidence the appliance was used to gain unauthorized access before the fix.” That means checking both the technical state of the appliance and the security state of the environment it protected.

At minimum, verify the vendor’s remediation guidance against the installed state, confirm the appliance is not left in an exposed or partially mitigated configuration, and review logs for suspicious access before and after remediation. If the device mediated privileged access, service access, or administrative sessions, treat credential and session review as part of closure, not an optional follow-up.

Where compromise cannot be ruled out cleanly, the response should expand from patching into containment and recovery. That may include credential reset, session invalidation, key rotation, and heightened monitoring on adjacent systems that accepted trust from the appliance. The point is to close the access path and then test whether anything else was already reached through it.

For a broader view of what attackers extract from edge appliances once they break in, Ivanti Connect Secure exploitation 2024 shows why credential and certificate review often belong in the same response as the patch itself.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-4 — Secure Configuration of Enterprise Assets and Software	Exposed edge appliances must be hardened and remediated consistently.
	CIS-7 — Continuous Vulnerability Management	The question is about patching or mitigating a known exploited vulnerability.
Recommendation — Apply secure configurations and remove exposed vulnerable appliance instances. Prioritise, patch, and verify the vulnerable appliance using continuous vulnerability management.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This CVE requires vendor-directed remediation or mitigation.
	AC-17 — Remote Access	The product provides remote access, so controlling exposure and trust boundaries is central.
Recommendation — Apply vendor remediation and verify the flaw is closed in production. Restrict remote access paths and remove Internet exposure until remediation is verified.
ISO/IEC 27001:2022	A.8.8 — Management of technical vulnerabilities	Patch and mitigation decisions are governed by technical vulnerability management.
Recommendation — Track the appliance as a technical vulnerability until remediation and validation are complete.

Practitioner Guidance

What to prioritise: Patch or mitigate exposed instances first, then prove the bypass path is removed. For remote-access appliances, exposure reduction is often the fastest safe control when remediation cannot be confirmed immediately.

What to verify: Confirm each appliance is covered by the vendor’s documented fix or mitigation, and that no internet-facing instance remains in a trusted authentication role without that protection in place.

Decision rule: If you cannot verify a working fix, treat continued external exposure as an exception that needs containment, not reassurance. If you suspect the appliance was reachable during the vulnerable period, add compromise review and credential hygiene to the same workstream.

Practitioner takeaway: For authentication-bypass flaws on edge access products, the real finish line is not patch deployment alone, but restored trust in the gateway, or a deliberate decision to remove it from service if that trust cannot be proven.