CVE-2023-46805

This flaw lives in the web-facing parts of certain Ivanti security systems. Normally, when you visit a protected page, the system checks whether you’re allowed in; this bug lets a remote attacker “pretend” they passed those checks and reach restricted resources anyway. Think of it like a building where the receptionist is supposed to verify your badge, but this vulnerability lets someone slip through the gate without proving they’re authorized.

This matters to you if you run or manage Ivanti ICS (versions 9.x and 22.x), Ivanti IPS, Ivanti Policy Secure, or Ivanti Connect Secure, especially if they’re reachable from the internet or from untrusted networks. Ivanti Policy Secure and the Ivanti web components are specifically called out as affected. If you don’t use these Ivanti products, this CVE likely doesn’t apply to you.

This is RED for a reason: it has a very high likelihood of being exploited, public attacks are available, and it has been used in the real world in ransomware. Even if exploitation was not widely reported as active in the same way everywhere, the combination of known exploited status and available tools means you should treat this as an urgent patching and exposure-reduction task. Start now rather than waiting for a “quiet period” to end.

1. Identify exposure and scope

• Confirm which of these products you run: Ivanti ICS (9.x and/or 22.x), Ivanti IPS, Ivanti Connect Secure (often referred to as Ivanti Connect Secure / Ivanti Connect Secure), and Ivanti Policy Secure (Ivanti Policy Secure).
• Determine whether the affected web component is reachable from the internet or any untrusted network segments.
• Review recent access logs for unusual requests to protected or “restricted” web resources.

2. Patch immediately

• Obtain and apply Ivanti’s remediations for CVE-2023-46805 to all affected systems.
• Prioritize systems that are exposed to the internet, those that handle sensitive admin functions, and those used in incident-prone workflows (because the flaw can expose restricted resources).

3. Compensating controls if patching must wait

• Lock down network access to the Ivanti web interfaces:
  • Allow-list only required source IPs (e.g., your corporate networks) and block everything else.
  • Ensure access requires a trusted path (such as a VPN) rather than open internet access.
• Add monitoring for abnormal web behavior (e.g., repeated attempts to access restricted pages, spikes in failed/odd requests).

4. Validate and monitor

• After patching, re-check that the vulnerable functionality is no longer accessible by the same patterns used by public exploits.
• Continue monitoring for signs of compromise—especially after any attacker “discovery” traffic—because this type of bypass can lead to further compromise.

5. Incident readiness

• If you find evidence of attempted access or successful misuse, involve your security/incident response support promptly and consider broader containment steps (credential resets, session revocation, and reviewing other exposed systems).

CVE-2023-46805 is an authentication bypass in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure. The weakness is described as bypassing control checks, which can allow a remote attacker to access restricted resources without proper authorization. The CVE is listed as known exploited in the wild (CISA KEV) and is reported as being used in ransomware, and a public exploit is available; a Nuclei detection template also exists, which increases the likelihood that automated scanning/attacks are being attempted. The provided exploitation status (from press) says none, but that does not reduce the urgency given KEV status, public exploit availability, and very high EPSS (100.0% estimated probability of exploitation in the next 30 days). EPSS is an estimate of how likely exploitation is in the near term; KEV indicates the vulnerability is actively exploited or has been confirmed as exploited in the wild. Given these factors, defenders should treat it as actively weaponized and prioritize patching and exposure reduction.