Skip to content
feed: live about
>_ 0dayNews
Vendor

Ivanti

Coverage of Ivanti Connect Secure, Policy Secure, and related edge VPN appliance vulnerabilities — a recurring target for nation-state and ransomware actors alike.

CVEs
CVE-2023-46805
[ HIGH ] CVSS 8.2 kev

Ivanti Connect Secure / Policy Secure Authentication Bypass

An authentication-bypass vulnerability in the web component of Ivanti Connect Secure and Policy Secure gateways allows a remote attacker to access restricted resources without credentials. Chained with CVE-2024-21887 for full remote code execution in real-world attacks.

Ivanti / Connect Secure and Policy Secure
CVE-2024-21887
[ CRITICAL ] CVSS 9.1 kev

Ivanti Connect Secure / Policy Secure Command Injection

A command-injection vulnerability in the web components of Ivanti Connect Secure and Policy Secure lets an authenticated administrator send specially crafted requests to execute arbitrary commands. Chained with CVE-2023-46805's auth bypass for unauthenticated RCE in the wild.

Ivanti / Connect Secure and Policy Secure
Articles
~/articles/2026-06-26-ivanti-connect-secure-chained-zero-days-explained
Inside the Ivanti Connect Secure Zero-Day Chain Attackers Used Before a Patch Existed
Explainer
ivanti

Inside the Ivanti Connect Secure Zero-Day Chain Attackers Used Before a Patch Existed

CVE-2023-46805 and CVE-2024-21887, chained together, gave a suspected nation-state actor unauthenticated remote code execution on Ivanti Connect Secure and Policy Secure VPN gateways for weeks before patches.

read →