Vulnerability threat dossier
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
VTP analyst assessment
CISA KEV establishes known global exploitation and known ransomware-campaign use. The web component of Ivanti Connect Secure and Policy Secure permits unauthenticated remote access to restricted resources by bypassing control checks.
1 record references and 2 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.
The accessible resources and any downstream exploit chain are not described.
No first-party telemetry, public-intelligence assertions, or exploit artifact is supplied.
First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.
Identify affected Connect Secure and Policy Secure versions and verify remediation.
First-party deterministic correlation
Honeypot request semantics are strongly consistent with CVE-2023-46805. This identifies likely attack intent, not successful exploitation or execution.
Basis: deterministic technical candidate
First-party deterministic correlation
Honeypot request semantics are strongly consistent with CVE-2023-46805. This identifies likely attack intent, not successful exploitation or execution.
Basis: deterministic technical candidate
First-party deterministic correlation
The request shares exploitation-associated characteristics with CVE-2023-46805, but the evidence does not identify one CVE with sufficient confidence.
Basis: deterministic technical candidate
VTP deterministic assessment
CISA KEV lists this vulnerability as known to be exploited globally.
EPSS is 1.00; this is predictive context, not exploitation evidence.
Exploitation attempts against this CVE were confirmed by first-party telemetry.
First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.
Material change ledger
Claim provenance
0 primary sources · 0 dependent secondary reports · 0 reports with unresolved independence. Repetition remains visible without multiplying confirmation.
Event history
CISA lists global known exploitation. This is not a VTP sensor observation.
Original publications
Technical vulnerability data
Raw observations
First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.