CVE-2023-46805Vulnerability

1. “…e threat actor was previously seen exploiting zero-days in Citrix NetScaler (CVE-2023-4966, aka CitrixBleed), Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282), and Dell RecoverPoint for Virtual Machines (CVE-2026-22769).”

   SecurityWeekNews16 Oct 2026
   Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day

2. “Armory Castle has a history of exploiting zero-day vulnerabilities in Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282) appliances to break a wide range of sectors, including legal services, SaaS providers, business-pro…”

   The Hacker NewsNews16 Oct 2026
   China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

3. “…CVE-2026-102764, ARMORY CASTLE may conduct widespread exploitation similar to what GTIG observed in 2024 following the disclosure of CVE-2023-46805 and CVE-2024-21887.”

   Google Threat IntelligenceVendor15 Oct 2026
   ARMORY CASTLE Exploits BeyondTrust

4. “…the attackers added more entry points, and FortiGuard's list now stands at 24 vulnerabilities, including Ivanti Connect Secure flaws CVE-2023-46805 and CVE-2024-21887 and newer bugs such as CVE-2026-36356 and CVE-2025-67038.”

   Infosecurity MagazineNews5 Oct 2026
   ClingSTUN Malware Turns Unpatched IoT Devices Into Proxy Nodes

5. “CVE-2023-46805: (54588) Ivanti.Connect.Secure.Policy.Secure.Authentication.Bypass”

   Fortinet Threat ResearchVendor5 Oct 2026
   ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure

6. “The advisory lists CVE-2024-21887 in Ivanti Connect Secure, commonly chained after the CVE-2023-46805 authentication bypass, and CVE-2024-3400 in Palo Alto PAN-OS GlobalProtect, along with CVE-2023-20273, a Cisco IOS XE flaw commonly chained with the CVE-2023-20198 authentication…”

   CybleVendor25 Sep 2026
   Inside the Telecom Attack Surface: SS7, BGP Hijacking, and the Technical Reality of Nation-State Intrusions

• hxxps://www.wyden.senate[.]gov/imo/media/doc/wyden-schmitt_dod_letter.pdfin 1 report
• hxxps://docs.fcc[.]gov/public/attachments/DOC-402579A1.pdfin 1 report
• hxxps://www.washingtonpost[.]com/national-security/2024/11/21/salt-typhoon-china-hack-telecom/in 1 report
• hxxps://docs.fcc[.]gov/public/attachments/FCC-24-62A1.pdfin 1 report
• hxxps://www.uscc[.]gov/sites/default/files/annual_reports/2010-Report-to-Congress.pdfin 1 report
• www.uscc[.]govin 1 report

Also named with it: CVE-2024-21887, CVE-2026-102764, CVE-2025-67038, CVE-2023-4966, CVE-2025-0282, CVE-2022-36553, CVE-2025-34035, CVE-2024-23625, CVE-2026-36356, CVE-2026-22769, CVE-2016-20016, CVE-2023-20198, CVE-2024-3400, CVE-2023-20273