Ivanti Connect Secure Zero-Day Chain: Unauthenticated RCE

What to do

1. Upgrade every gateway to a current supported release that includes the January 31, February 1 and February 8, 2024 fixes or later.
2. Run Ivanti's external Integrity Checker Tool, and collect memory, logs and disk images before anything that reboots the appliance.
3. If you were ever unpatched, export the config, factory reset, rebuild on a patched image and reimport, as CISA ED 24-01 required.
4. Reset admin, API and local-user credentials on the appliance, and treat any credentials that passed through the VPN as compromised.
5. Reset domain account passwords (twice for privileged accounts), revoke Kerberos tickets and tokens, and hunt for lateral movement from the appliance's internal IP.

How to check if you are affected or compromised

• Integrity Checker Tool events SYS32039 (new files) or SYS32040 (mismatched files).
• Gaps in logs, or logging disabled on the appliance.
• Unexpected outbound connections from the appliance, or RDP, SMB, SSH and scanning from it to internal hosts.
• Unusual requests to rarely used paths such as /dana-na/help/, and modified compcheckresult.cgi, lastauthserverused.js or visits.py.

What happened#

On January 10, 2024, Ivanti disclosed two vulnerabilities in its Connect Secure (formerly Pulse Secure) VPN and Policy Secure gateways, and Volexity published evidence they had been chained as zero-days. CVE-2023-46805 is an authentication bypass in the web component (CVSS 8.2). CVE-2024-21887 is a command injection that lets an authenticated administrator run arbitrary commands (CVSS 9.1). Together they give an unauthenticated attacker remote code execution on the appliance.

Volexity spotted the activity in the second week of December 2023, with suspect activity dating to at least December 3, and attributed it to a suspected Chinese nation-state actor it tracks as UTA0178. The attackers backdoored legitimate files to steal VPN logins, dropped webshells, wiped logs, tampered with files to evade Ivanti's Integrity Checker Tool, and moved laterally into the network.

A fixed release was not available at disclosure; customers got a mitigation XML first. Patches arrived on January 31 and February 1, 2024, and Ivanti's update disclosed two more flaws fixed by them: CVE-2024-21888 (privilege escalation) and CVE-2024-21893, an unauthenticated SSRF in the SAML component that also affects Neurons for ZTA. A further issue, CVE-2024-22024, was added to CISA's directive on February 9.

Who is affected#

Ivanti Connect Secure and Policy Secure 9.x and 22.x; Ivanti said the original issues affected all supported versions. Fixed builds include Connect Secure 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2, 22.5R1.1 and 22.5R2.2, Policy Secure 22.5R1.1, and ZTA 22.6R1.3. Ivanti states other products are not affected.

Do you really need to act?#

Yes. This is about as serious as edge-device bugs get. All three of CVE-2023-46805, CVE-2024-21887 and CVE-2024-21893 are in the KEV catalog as of October 21, 2026, each marked as known to be used in ransomware campaigns. CISA issued Emergency Directive 24-01 on January 19, 2024, then ordered federal agencies to disconnect all affected products by February 2 and factory reset them before returning to service. CISA warned that attackers had worked around earlier mitigations and limited the Integrity Checker's effectiveness, and that persistence could survive a factory reset.

The key point: patching does not undo a compromise. If your gateway was exposed and unpatched during this window, treat it, and the credentials that passed through it, as compromised.

What to do now#

1. Upgrade every gateway to a current supported release that includes the January-February 2024 fixes or later.
2. Before rebooting, capture memory, logs and disk images; the enhanced Integrity Checker reboots the appliance and overwrites memory.
3. Run the external Integrity Checker Tool. If you were ever unpatched, factory reset and rebuild on a patched image, then reimport the configuration.
4. Reset admin, API and local-user credentials on the appliance, and assume VPN user credentials were stolen.
5. Reset domain passwords (privileged accounts twice), revoke Kerberos tickets and tokens, and hunt for lateral movement.

How to tell if you were hit#

Volexity noted that exploit requests did not show up in logs, even with unauthenticated request logging enabled, so do not rely on access logs. Look instead for Integrity Checker events SYS32039 or SYS32040, gaps in logs or disabled logging, unexpected outbound connections from the appliance, internal RDP, SMB or SSH sessions originating from it, and unusual requests to rarely used paths such as /dana-na/help/. Modified compcheckresult.cgi, lastauthserverused.js or visits.py were among the documented implants.

Timeline#

• Dec 3, 2023 — Earliest suspect activity Volexity identified.
• Jan 10, 2024 — Ivanti discloses CVE-2023-46805 and CVE-2024-21887 with a mitigation; CISA adds both to KEV.
• Jan 19, 2024 — CISA issues Emergency Directive 24-01.
• Jan 31, 2024 — First patches; CVE-2024-21888 and CVE-2024-21893 disclosed; CVE-2024-21893 added to KEV; CISA orders disconnection by Feb 2.
• Feb 9, 2024 — CISA adds CVE-2024-22024 to the directive.
• Oct 21, 2026 — All three exploited CVEs remain in KEV; brief updated.

Vulnerability records

• CVE-2023-46805 · KEV 2024-01-10 · An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted…
• CVE-2024-21887 · KEV 2024-01-10 · A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated…
• CVE-2024-21893 · KEV 2024-01-31 · A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons…
• CVE-2024-21888 · A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate…
• CVE-2024-22024 · An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Ivanti — Security Update for Ivanti Connect Secure and Ivanti Policy Secure Gateways ivanti.com
2. Volexity — Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN volexity.com
3. CISA — ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities cisa.gov
4. NVD — CVE-2023-46805 nvd.nist.gov
5. NVD — CVE-2024-21887 nvd.nist.gov
6. NVD — CVE-2024-21893 nvd.nist.gov
7. CISA — Known Exploited Vulnerabilities Catalog cisa.gov