[HIGH PRIORITY] Ivanti Connect Secure Auth Bypass (CVE-2023-46805)

⚠ HIGH PRIORITY — CISA KEV. CVE-2023-46805 is an authentication bypass in Ivanti Connect Secure VPN. Chained with CVE-2024-21887 command injection for unauthenticated RCE on Linux-based ICS appliances.

Affected Ivanti

• Ivanti Connect Secure 9.x before 9.1R14
• Ivanti Policy Secure before fixed builds
• Internet-exposed VPN gateways

Check version

show version
curl -sk https://vpn.example.com/dana-na/ | head -3

Patching Method

1. Apply Ivanti cumulative patch to minimum 9.1R14 or 22.7R2.1 per advisory.
2. Run Ivanti ICT (Integrity Checker Tool) before patching — save report.
3. Import patch via admin console; allow full reboot.
4. Re-run ICT after patch — investigate any failures.
5. Also patch CVE-2024-21887 if not on fixed build.
6. Force password reset for all VPN users and admins.

# Post-patch persistence hunt
last -20
find /home -name '*.pl' -o -name 'c.cgi' 2>/dev/null

Until patched

• Disable VPN portal at perimeter firewall
• Use Ivanti external ICT if internal patching delayed
• Assume compromise if exposed without patch for >72 hours