CVE-2023-46805

Exploited in the Wild ✓ Confirmed 0-Day

Triaged: March 5, 2026 22 articles

VulnLookup ↗ NVD ↗ MITRE ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

94.37%

probability

This CVE has a 94.37% probability of being exploited in the next 30 days.

0% Top 100.0th percentile of all CVEs 100%

CVSS score unavailable

Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Attack Intelligence

CWE-284 · Improper Access Control CWE-287 · Improper Authentication

Exploits & PoC

duy-31/CVE-2023-46805_CVE-2024-21887

An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restri

Chocapikk/CVE-2023-46805

Ivanti Pulse Secure CVE-2023-46805 Scanner - Based on Assetnote's Research

seajaysec/Ivanti-Connect-Around-Scan

Mitigation validation utility for the Ivanti Connect Around attack chain. Runs multiple checks. CVE-2023-46805, CVE-2024-21887.

yoryio/CVE-2023-46805

Scanner for CVE-2023-46805 - Ivanti Connect Secure

cbeek-r7/CVE-2023-46805

Simple scanner for scanning a list of ip-addresses for vulnerable Ivanti Pulse Secure devices

Hexastrike/Ivanti-Connect-Secure-Logs-Parser

A Python script for examining Ivanti Secure Connect (ICS) event logs, designed to support investigations into vulnerabilities CVE-2025-0282, CVE-2023-

raminkarimkhani1996/CVE-2023-46805_CVE-2024-21887

The script in this repository only checks whether the vulnerabilities specified in the Ivanti Connect Secure product exist.

w2xim3/CVE-2023-46805

CVE-2023-46805 Ivanti POC RCE - Ultra fast scanner.

rxwx/pulse-meter

Parses the System Snapshot from an Ivanti Connect Secure applicance to identify possible IOCs related to CVE-2023-46805, CVE-2024-21887 and CVE-2025-0

9 repos — triés par ⭐ Rechercher sur GitHub ↗

Cybersecurity Threat Landscape 2024 Midyear Review

Qualys Aug 06, 2024

Ivanti warns of new Connect Secure zero-day exploited in attacks

BleepingComputer Jan 31, 2024

Alert: Ivanti Discloses 2 New Zero-Day Flaws, One Under Active Exploitation

TheHackerNews

Ivanti patches Connect Secure zero-day exploited since mid-March

BleepingComputer Apr 03, 2025

CISA emergency directive: Mitigate Ivanti zero-days immediately

BleepingComputer Jan 19, 2024

Ivanti Connect Secure zero-days now under mass exploitation

BleepingComputer Jan 15, 2024

Ivanti warns of Connect Secure zero-days exploited in attacks

BleepingComputer Jan 10, 2024

Google Reports 75 Zero-Days Exploited in 2024 — 44% Targeted Enterprise Security Products

TheHackerNews

Inside the customer environment: Where threat actors, vulnerabilities, and exposed assets intersect

Tenable-Research May 27, 2026

Ivanti Connect Secure zero-days exploited to deploy custom malware

BleepingComputer Jan 12, 2024

Security Advisory 2024-004

CERT-EU Feb 09, 2024

Warning: New Ivanti Auth Bypass Flaw Affects Connect Secure and ZTA Gateways

TheHackerNews

⚡ THN Weekly Recap: Router Hacks, PyPI Attacks, New Ransomware Decryptor, and More

TheHackerNews

Recent SSRF Flaw in Ivanti VPN Products Undergoes Mass Exploitation

TheHackerNews

MITRE says state hackers breached its network via Ivanti zero-days

BleepingComputer Apr 19, 2024

Ivanti: VPN appliances vulnerable if pushing configs after mitigation

BleepingComputer Jan 22, 2024

Hackers Exploiting Ivanti VPN Flaws to Deploy KrustyLoader Malware

TheHackerNews

Nation-State Actors Weaponize Ivanti VPN Zero-Days, Deploying 5 Malware Families

TheHackerNews

RedTail Crypto-Mining Malware Exploiting Palo Alto Networks Firewall Vulnerability

TheHackerNews

Exploit Attempts Recorded Against New MOVEit Transfer Vulnerability - Patch ASAP!

TheHackerNews

Signal Intelligence

Confidenceⓘ

92%

EPSS 94.37%

Mentions 22

Last Seen May 27, 2026

CNA Information

Analyst Note

CVE-2023-46805 is explicitly named as a zero-day exploited in the wild across multiple authoritative sources (BleepingComputer, CISA emergency directive). Articles document active attacks and simultaneous patch availability, with exploitation reported since mid-March 2024 and mass exploitation following disclosure. Clear zero-day criteria met.