Frequently asked questions for five CVEs affecting Ivanti Connect Secure and Policy Secure Gateways, with three of the vulnerabilities having been exploited in the wild as zero-days.

CVE-2023-46805, CVE-2024-21887, CVE-2024-21888 and CVE-2024-21893: Frequently Asked Questions for Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways

Two zero-day vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure have been exploited in the wild, with at least one attack attributed to nation-state actors.

CVE-2023-46805, CVE-2024-21887: Zero-Day Vulnerabilities Exploited in Ivanti Connect Secure and Policy Secure Gateways

An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.

One of several CVEs identified by the NSA and other global agencies as being associated with People's Republic of China state-sponsored threat actor activity in August 2025.

Mass exploitation has been observed for all three of these CVEs and an increase in attacks has spiked starting on Feb. 2 around the time a PoC was released for CVE-2024-21893.

APT groups have been attributed to exploitation of these CVEs. While patches have not yet been released, mitigation guidance is available and should be implemented.

Widespread exploitation has been observed for CVE-2024-21887 and CVE-2023-46805. Over 2,100 systems confirmed compromised according to Volexity. Recent observations include distribution of XMRig cryptocurrency miner. Applying the mitigation is paramount at this stage.

Chaining of these two CVEs allows an unauthenticated attacker to execute arbitrary code on an affected device. Currently, limited active exploitation has been observed and while a patch is not yet available, a mitigation has been provided by Ivanti.

The Ivanti Policy Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by multiple vulnerabilities:

  - An authentication bypass vulnerability in the web component of Ivanti Policy Secure (9.x, 22.x) and Ivanti Policy     Secure allows a remote attacker to access restricted resources by bypassing control checks. (CVE-2023-46805)

  - A command injection vulnerability in web components of Ivanti Policy Secure (9.x, 22.x) and Ivanti Policy Secure     allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the     appliance. This vulnerability can be exploited over the internet. (CVE-2024-21887)

  - A privilege escalation vulnerability in web component of Ivanti Policy Secure (9.x, 22.x) and Ivanti Policy Secure     (9.x, 22.x) allows a user to elevate privileges to that of an administrator. (CVE-2024-21888)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Ivanti Policy Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by an authentication bypass vulnerability in the web component of Ivanti Policy Secure (9.x, 22.x) which allows a remote attacker to access restricted resources by bypassing control checks.

The Ivanti Connect Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by an authentication bypass vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) which allows a remote attacker to access restricted resources by bypassing control checks.

Ivanti Connect Secure 9.x, 22.x suffers from an authentication bypass vulnerability.

By crafting a specific HTTP request, a remote and unauthenticated attacker could exploit this vulnerability to bypass authentication and authorization requirements.

The Ivanti Connect Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by multiple vulnerabilities:

  - An authentication bypass vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy     Secure allows a remote attacker to access restricted resources by bypassing control checks. (CVE-2023-46805)

  - A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure     allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the     appliance. This vulnerability can be exploited over the internet. (CVE-2024-21887)

  - A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure     (9.x, 22.x) allows a user to elevate privileges to that of an administrator. (CVE-2024-21888)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
190367	Ivanti Policy Secure 9.x / 22.x Multiple Vulnerabilities	Nessus	Misc.	Remote	critical
189949	Ivanti Policy Secure 9.x / 22.x Authentication Bypass Vulnerability (CVE-2023-46805)	Nessus	CGI abuses	Remote	high
189948	Ivanti Connect Secure 9.x / 22.x Authentication Bypass Vulnerability (CVE-2023-46805)	Nessus	CGI abuses	Remote	high
114165	Ivanti Connect Secure 9.x / 22.x Authentication Bypass	Web App Scanning	Component Vulnerability	Check Based	critical
187908	Ivanti Connect Secure 9.x / 22.x Multiple Vulnerabilities	Nessus	Misc.	Remote	critical

Detections

Analytics

CVE-2023-46805

critical

Tenable Plugins

critical

high

high

critical

critical