On January 10, 2024, CISA issued an alert warning that Ivanti Connect Secure and Policy Secure contain vulnerabilities CVE-2023-46805 and CVE-2024-21887 [1]. Officials stated that both vulnerabilities were being actively exploited in the wild and added them to the Known Exploited Vulnerabilities (KEV) catalog [2]. CISA subsequently issued an Emergency Directive and joint advisory requiring organizations to immediately apply vendor mitigations, install patches, and hunt for implanted web shells [3].
Backfill: this event became public on Jan 10, 2024 and we added it on Nov 8, 2026. It is not a new event.
CISA Warns of Active Exploitation of Ivanti Connect Secure Authentication Bypass and Command Injection Vulnerabilities
1 min read
- Disclosed
- Jan 10, 2024
- Published
- Nov 8, 2026
- Last updated
- Nov 12, 2026
- CVSS basis
- Our assessment
- 100%, higher than 100% of CVEs
- Exploitation and patch status
- Exploited
- Attack vector
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Organisations running: Ivanti Connect Secure / Policy Secure
What to do nowOur advice
CISA subsequently issued an Emergency Directive and joint advisory requiring organizations to immediately apply vendor mitigations, patch systems, and inspect for implanted web shells [3].
Affected scope
| Affected scope | Versions | Fixed in | |
|---|---|---|---|
| Ivanti Connect Secure / Policy Secure | 支援中的 9.x 與 22.x（見 CISA 與 Ivanti 公告）[1] | — | ✗ Unpatched |
Do you run this product?
Add it to your systems list and we'll email you about related advisories and major updates.
Timeline
Technical details
Source-Supported Details
Immediately apply Ivanti mitigations and patches, restrict external gateway connectivity, and conduct threat hunting in accordance with CISA advisories rather than relying solely on the Integrity Checker Tool [1].
Source excerpt: "Ivanti has released a security update to address an authentication bypass vulnerability ( CVE-2023-46805 ) and a command injection vulnerability ( CVE-2024-21887 ) in all supported versions (9.x and 22.x) of Connect Secure and Policy Secure gateways." [1].
Source excerpt: "CVE-2024-21887 Ivanti Connect Secure and Policy Secure Command Injection Vulnerability CVE-2023-46805 Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose signifi" [2].
References
Official / primary5
- [1]
“Ivanti has released a security update to address an authentication bypass vulnerability ( CVE-2023-46805 ) and a command injection vulnerability ( CVE-2024-21887 ) in all supported versions (9.x and 22.x) of Connect Secure and Policy Secure gateways.”
- [2]
Corrections
- · countries: 攻擊來源：美國 → 原本把美國標成攻擊來源，但來源沒有指出攻擊者來自美國或受其支持，因此移除。
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.