Is CVE-2023-46805 (Ivanti Connect Secure and Policy Secure Authentication Bypass) being exploited in the wild?

Yes. CISA added CVE-2023-46805 to its Known Exploited Vulnerabilities catalogue on 10 January 2024, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks.

What “being exploited in the wild” means for this Ivanti CVE

This question is about exploitation status, not just vulnerability existence. For CVE-2023-46805, the practical answer is whether attackers are already using the Ivanti Connect Secure and policy secure authentication bypass against real systems, which is why the most useful starting point is the official vulnerability record and the KEV listing. The CVE record gives the canonical identifier, while the KEV catalogue signals confirmed active abuse.

When a VPN gateway flaw is being exploited in the wild, the security question shifts from abstract exposure to immediate exposure management. That means confirming whether the appliance is internet-facing, whether it is in the affected product family, and whether there are any signs of unauthorised access before assuming the box is simply “patched enough.” For this class of edge device, exploitation can be fast-moving and operationally noisy, especially when the flaw is used to reach protected internal resources.

Authoritative tracking matters here because exploitation status changes the response threshold. A CVE can be technically serious without yet being widely abused, but once it appears in CISA’s Known Exploited Vulnerabilities Catalog, defenders should treat it as an active attack path rather than a theoretical weakness. The same is true when you cross-check the entry against the CVE Program and the NIST National Vulnerability Database for the canonical vulnerability record and metadata.

Why this matters for edge VPN appliances

Authentication bypass on a remote access gateway is especially sensitive because the appliance sits at a trust boundary. If an attacker can skip control checks, they may reach internal applications, administrative functions, or downstream sessions that were supposed to be protected by the gateway. That makes the issue more than a single login defect, because the affected system often acts as a front door to multiple other assets.

For Ivanti Connect Secure and Policy Secure, the right mental model is “edge compromise risk,” not “single product bug.” Even before you know whether data theft occurred, a bypass on a perimeter access device can create a foothold for follow-on activity such as credential capture, session abuse, internal recon, and movement to adjacent systems. In other words, the question is not only whether the appliance is vulnerable, but whether it has already been used as a bridge into the environment.

If you need a broader playbook for exposed remote access appliances, VPN Security Guide is the most directly relevant internal reference for hardening, patching, logging, and replacement decisions. For incident-driven edge-device compromise, Ivanti Connect Secure exploitation 2024 is the closest match because it covers the same platform family and the downstream credential-theft pattern defenders need to anticipate.

What practitioners should do once KEV confirms active exploitation

When a vulnerability is in KEV, the decision is no longer “is this worth prioritising?” The decision becomes how quickly you can confirm exposure, apply the vendor fix or CISA-required action, and determine whether the appliance was already abused. If patching must wait, the temporary objective is to reduce exposure, limit reachable services, and preserve evidence for later investigation rather than assuming the issue can be safely deferred.

On this kind of device, the first verification step is to inventory every internet-reachable Ivanti instance, confirm its exact role, and review logs for unusual logins, new sessions, odd administrative actions, or unexpected outbound connections. If the gateway mediated privileged access, treat password rotation, session invalidation, and service-account review as part of the response, not as optional cleanup.

For practical prioritisation, the best external triage aids are the FIRST EPSS score for likelihood context and the KEV catalogue for confirmation that exploitation is no longer hypothetical. For defenders who want a structured response path for zero-days and actively exploited flaws, the Zero-Day and Exploited Vulnerabilities Guide and Vulnerability Management Guide provide the operational sequencing for emergency triage, verification, and exception handling.

Risk and Threat Considerations

Once an authentication bypass on a perimeter VPN is publicly exploited, the main risk is that the gateway stops being a control point and becomes an access path. That can expose internal networks, authenticated sessions, and privileged workflows, especially where the appliance is tied to remote administration or third-party access.

Failure mechanism: The attacker bypasses authentication checks in the web component, reaches restricted resources without valid access, and may then pivot to session abuse, credential harvesting, or internal reconnaissance before defenders notice.

Impact: Organisations may face unauthorised access to sensitive systems, loss of trust in remote access sessions, emergency credential rotation, and a broader incident response because an edge device can create exposure well beyond the appliance itself.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	Active exploitation makes rapid vulnerability identification and monitoring central to response.
	IR-4 — Incident Handling	KEV status and bypass exploitation require coordinated incident handling and evidence review.
	IA-2 — Identification and Authentication (Organizational Users)	The issue is an authentication bypass affecting access control at the gateway.
Recommendation — Prioritise scanning and exposure confirmation for internet-facing Ivanti appliances. Trigger incident handling when logs or indicators suggest the appliance was abused. Validate and harden authentication controls for administrative and remote-access entry points.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation requires prioritised remediation and exposure tracking.
	CIS-17 — Incident Response Management	Active exploitation demands incident response, not just patching.
Recommendation — Track and remediate the Ivanti vulnerability as a high-priority exposure. Use incident response procedures to investigate possible gateway compromise.

Practitioner Guidance

What to prioritise: Treat confirmed KEV status as a hard prioritisation signal. If the appliance is internet-facing, exposed to users, or used by admins, it should move ahead of routine patch queues and be triaged alongside any evidence of prior access.

What to verify: Check whether the box has unusual authentication events, new administrative sessions, suspicious configuration changes, unexpected outbound traffic, or signs that credentials or sessions were captured. If the appliance was used for privileged remote access, validate downstream accounts and sessions as well.

Decision rule: If you cannot patch immediately, reduce exposure first, monitor closely, and assume compromise is plausible until logs and endpoint evidence say otherwise. For edge VPN flaws, “no obvious alert” is not the same as “no exploitation.”

Practitioner takeaway: For KEV-listed VPN gateway flaws, the safe assumption is active abuse until disproven, and the response must combine patching, exposure reduction, and compromise assessment rather than relying on patch status alone.