CVE-2023-46805: Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability

High severity, CVSS 8.2. Actively exploited: in CISA KEV since 2024-01-10. EPSS: 100% chance of exploitation in the next 30 days.

An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.

Affected products

• Ivanti Connect Secure: version 9.0 only; version 9.1 only; version 22.1 only; version 22.2 only; version 22.3 only; version 22.4 only; …
• Ivanti Policy Secure: version 9.0 only; version 9.1 only; version 22.1 only; version 22.2 only; version 22.3 only; version 22.4 only; …

Published 2024-01-12. Last modified 2026-10-01.