CVE-2023-46805

HighCVSS 8.2/10Known exploited (CISA KEV)Last modified Oct 1, 2026

Description

An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Ivanti	ICS	>= 9.1R18, <= 9.1R18; >= 22.6R2, <= 22.6R2
Ivanti	IPS	>= 9.1R18, <= 9.1R18; >= 22.6R1, <= 22.6R1

References

http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_USVendor Advisory
http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_USVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46805US Government Resource

Timeline

Published: Jan 12, 2024
Last modified: Oct 1, 2026
Added to CISA KEV: Jan 10, 2024
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-468066.7An SQL Injection vulnerability in a web component of EPMM versions before 12.1.0.0 allows an authenticated user with appropriate privilege t CVE-2023-468076.7An SQL Injection vulnerability in web component of EPMM before 12.1.0.0 allows an authenticated user with appropriate privilege to access or CVE-2023-468089.9An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Success CVE-2023-468097.4Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are CVE-2023-46815.5NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3-DEV.CVE-2023-468107.3A local privilege escalation vulnerability in Ivanti Secure Access Client for Linux before 22.7R1, allows a low privileged user to execute c CVE-2023-468137.0An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect acce CVE-2023-468147.8A binary hijacking vulnerability exists within the VideoLAN VLC media player before 3.0.19 on Windows. The uninstaller attempts to execute c CVE-2023-468158.8An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. An Unrestricted File Upload vulnerability has been identified in CVE-2023-468168.8An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulnerability has been id CVE-2023-468179.8An issue was discovered in phpFox before 4.8.14. The url request parameter passed to the /core/redirect route is not properly sanitized befo CVE-2023-468187.2An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_al