---
title: "Ivanti Connect Secure Zero-Day Chain: Unauthenticated RCE"
url: https://erroneo.us/security/briefs/ivanti-connect-secure-auth-bypass-command-injection/
description: "CVE-2023-46805 + CVE-2024-21887 chained for unauthenticated RCE on Ivanti Connect/Policy Secure 9.x and 22.x. Exploited since Dec 2023, in KEV. Act now."
type: security-brief
section: "Security Digest"
date_published: 2024-01-10
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2023-46805", "CVE-2024-21887", "CVE-2024-21893", "CVE-2024-21888", "CVE-2024-22024"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Ivanti Connect Secure Zero-Day Chain: Unauthenticated RCE

**Verdict: Act now.** This chain was exploited as a zero-day by a suspected nation-state actor and then mass-exploited; any unpatched appliance should be assumed compromised, not just patched.

- **Who must act:** Anyone running Ivanti Connect Secure or Policy Secure 9.x or 22.x, and anyone who ran an unpatched gateway between December 2023 and the February 2024 patches.
- **Who can relax:** Organizations with no Ivanti Connect Secure, Policy Secure or Neurons for ZTA gateways; Ivanti says other products are not affected.
- **Affected:** Ivanti Connect Secure 9.x and 22.x (all supported versions at disclosure); Ivanti Policy Secure 9.x and 22.x; Ivanti Neurons for ZTA (CVE-2024-21893)
- **Fixed:** Connect Secure 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2, 22.5R1.1 (Jan 31, 2024); Connect Secure 22.5R2.2 and Policy Secure 22.5R1.1 (Feb 1, 2024); ZTA 22.6R1.3; Later releases that also fix CVE-2024-22024 (Feb 8, 2024 update)
- **CVEs:** CVE-2023-46805, CVE-2024-21887, CVE-2024-21893, CVE-2024-21888, CVE-2024-22024
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Upgrade every gateway to a current supported release that includes the January 31, February 1 and February 8, 2024 fixes or later.
2. Run Ivanti's external Integrity Checker Tool, and collect memory, logs and disk images before anything that reboots the appliance.
3. If you were ever unpatched, export the config, factory reset, rebuild on a patched image and reimport, as CISA ED 24-01 required.
4. Reset admin, API and local-user credentials on the appliance, and treat any credentials that passed through the VPN as compromised.
5. Reset domain account passwords (twice for privileged accounts), revoke Kerberos tickets and tokens, and hunt for lateral movement from the appliance's internal IP.

### How to check if you are affected

- Integrity Checker Tool events SYS32039 (new files) or SYS32040 (mismatched files).
- Gaps in logs, or logging disabled on the appliance.
- Unexpected outbound connections from the appliance, or RDP, SMB, SSH and scanning from it to internal hosts.
- Unusual requests to rarely used paths such as /dana-na/help/, and modified compcheckresult.cgi, lastauthserverused.js or visits.py.

## What happened

On January 10, 2024, Ivanti disclosed two vulnerabilities in its Connect Secure (formerly Pulse Secure) VPN and Policy Secure gateways, and [Volexity published](https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/) evidence they had been chained as zero-days. [CVE-2023-46805](https://nvd.nist.gov/vuln/detail/CVE-2023-46805) is an authentication bypass in the web component (CVSS 8.2). [CVE-2024-21887](https://nvd.nist.gov/vuln/detail/CVE-2024-21887) is a command injection that lets an authenticated administrator run arbitrary commands (CVSS 9.1). Together they give an unauthenticated attacker remote code execution on the appliance.

Volexity spotted the activity in the second week of December 2023, with suspect activity dating to at least December 3, and attributed it to a suspected Chinese nation-state actor it tracks as UTA0178. The attackers backdoored legitimate files to steal VPN logins, dropped webshells, wiped logs, tampered with files to evade Ivanti's Integrity Checker Tool, and moved laterally into the network.

A fixed release was not available at disclosure; customers got a mitigation XML first. Patches arrived on January 31 and February 1, 2024, and Ivanti's [update](https://www.ivanti.com/blog/security-update-for-ivanti-connect-secure-and-ivanti-policy-secure-gateways) disclosed two more flaws fixed by them: CVE-2024-21888 (privilege escalation) and [CVE-2024-21893](https://nvd.nist.gov/vuln/detail/CVE-2024-21893), an unauthenticated SSRF in the SAML component that also affects Neurons for ZTA. A further issue, CVE-2024-22024, was added to CISA's directive on February 9.

## Who is affected

Ivanti Connect Secure and Policy Secure 9.x and 22.x; Ivanti said the original issues affected all supported versions. Fixed builds include Connect Secure 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2, 22.5R1.1 and 22.5R2.2, Policy Secure 22.5R1.1, and ZTA 22.6R1.3. Ivanti states other products are not affected.

## Do you really need to act?

Yes. This is about as serious as edge-device bugs get. All three of CVE-2023-46805, CVE-2024-21887 and CVE-2024-21893 are in the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) as of October 21, 2026, each marked as known to be used in ransomware campaigns. CISA issued [Emergency Directive 24-01](https://www.cisa.gov/news-events/directives/ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure-vulnerabilities) on January 19, 2024, then ordered federal agencies to disconnect all affected products by February 2 and factory reset them before returning to service. CISA warned that attackers had worked around earlier mitigations and limited the Integrity Checker's effectiveness, and that persistence could survive a factory reset.

The key point: patching does not undo a compromise. If your gateway was exposed and unpatched during this window, treat it, and the credentials that passed through it, as compromised.

## What to do now

1. Upgrade every gateway to a current supported release that includes the January-February 2024 fixes or later.
2. Before rebooting, capture memory, logs and disk images; the enhanced Integrity Checker reboots the appliance and overwrites memory.
3. Run the external Integrity Checker Tool. If you were ever unpatched, factory reset and rebuild on a patched image, then reimport the configuration.
4. Reset admin, API and local-user credentials on the appliance, and assume VPN user credentials were stolen.
5. Reset domain passwords (privileged accounts twice), revoke Kerberos tickets and tokens, and hunt for lateral movement.

## How to tell if you were hit

Volexity noted that exploit requests did not show up in logs, even with unauthenticated request logging enabled, so do not rely on access logs. Look instead for Integrity Checker events `SYS32039` or `SYS32040`, gaps in logs or disabled logging, unexpected outbound connections from the appliance, internal RDP, SMB or SSH sessions originating from it, and unusual requests to rarely used paths such as `/dana-na/help/`. Modified `compcheckresult.cgi`, `lastauthserverused.js` or `visits.py` were among the documented implants.

## Timeline

- Dec 3, 2023 — Earliest suspect activity Volexity identified.
- Jan 10, 2024 — Ivanti discloses CVE-2023-46805 and CVE-2024-21887 with a mitigation; CISA adds both to KEV.
- Jan 19, 2024 — CISA issues Emergency Directive 24-01.
- Jan 31, 2024 — First patches; CVE-2024-21888 and CVE-2024-21893 disclosed; CVE-2024-21893 added to KEV; CISA orders disconnection by Feb 2.
- Feb 9, 2024 — CISA adds CVE-2024-22024 to the directive.
- Oct 21, 2026 — All three exploited CVEs remain in KEV; brief updated.

## Sources

1. [Ivanti — Security Update for Ivanti Connect Secure and Ivanti Policy Secure Gateways](https://www.ivanti.com/blog/security-update-for-ivanti-connect-secure-and-ivanti-policy-secure-gateways)
2. [Volexity — Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN](https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/)
3. [CISA — ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities](https://www.cisa.gov/news-events/directives/ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure-vulnerabilities)
4. [NVD — CVE-2023-46805](https://nvd.nist.gov/vuln/detail/CVE-2023-46805)
5. [NVD — CVE-2024-21887](https://nvd.nist.gov/vuln/detail/CVE-2024-21887)
6. [NVD — CVE-2024-21893](https://nvd.nist.gov/vuln/detail/CVE-2024-21893)
7. [CISA — Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

---
Source page: https://erroneo.us/security/briefs/ivanti-connect-secure-auth-bypass-command-injection/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt