Ivanti Connect Secure zero-days chained for mass VPN compromise

Two Ivanti Connect Secure and Policy Secure zero-days, an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887), were chained for unauthenticated remote code execution on internet-facing VPN gateways. Volexity found them in the wild in December 2023 and disclosed them on 2024-01-10. A third bug, an SSRF in the SAML component (CVE-2024-21893), was exploited later in January. CISA issued Emergency Directive 24-01 and then ordered federal agencies to disconnect all Ivanti Connect Secure and Policy Secure appliances. Added to the CISA KEV catalog on 2024-01-10, 2024-01-31. CISA lists known use in ransomware campaigns.

Why this severity: CVSS 9.1 (v3.0, CNA), actively exploited (CISA KEV); known ransomware use

Started

Jan 10, 2024

Closed

Jan 31, 2024

CVEs

CVE-2023-46805CVE-2024-21887CVE-2024-21893

• #Ivanti
• #Ivanti Connect Secure
• #VPN
• Zero-day
• Auth bypass
• RCE
• CISA KEV
• Ransomware

Notes & caveats

Derived from the CISA KEV JSON feed (catalogVersion 2026.10.21); CVSS from the CVE record (cveawg.mitre.org). startedAt is the CVE publication date when it fell in 2024 before the KEV listing, else the KEV dateAdded; exploitation may have begun earlier. closedAt is the KEV listing date (a fix or mitigation was available then unless noted).