avalanche vulnerabilities and fixes

Recent CVEs affecting avalanche, with upgrade or downgrade steps. 22 tracked.

avalanche has 22 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 17. Most recent: 2025-08-12. Highest priority: CVE-2023-38036 (score 61/100).

• CVE-2025-8297 HIGH 7.2 UPGRADE Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenti
• CVE-2025-8296 HIGH 7.2 UPGRADE SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin
• CVE-2024-50331 HIGH 7.5 UPGRADE An out-of-bounds read vulnerability in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker
• CVE-2024-50321 HIGH 7.5 UPGRADE An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial o
• CVE-2024-50320 HIGH 7.5 UPGRADE An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial o
• CVE-2024-50319 HIGH 7.5 UPGRADE An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial o
• CVE-2024-50318 HIGH 7.5 UPGRADE A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause
• CVE-2024-50317 HIGH 7.5 UPGRADE A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause
• CVE-2024-47011 HIGH 7.5 UPGRADE Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensi
• CVE-2024-47010 HIGH 7.3 UPGRADE Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass aut
• CVE-2024-47009 HIGH 7.3 UPGRADE Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass aut
• CVE-2024-47008 HIGH 7.5 UPGRADE Server-side request forgery in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker
• CVE-2024-47007 HIGH 7.5 UPGRADE A NULL pointer dereference in WLAvalancheService.exe of Ivanti Avalanche before version 6.4.5 allows a remote
• CVE-2024-38653 HIGH 7.5 DOWNGRADE DOWNGRADE XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary
• CVE-2024-38652 CRITICAL 9.1 DOWNGRADE DOWNGRADE Path traversal in the skin management component of Ivanti Avalanche 6.3.1 allows a remote unauthenticated atta
• CVE-2024-37399 HIGH 7.5 DOWNGRADE DOWNGRADE A NULL pointer dereference in WLAvalancheService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated att
• CVE-2024-37373 HIGH 7.2 DOWNGRADE DOWNGRADE Improper input validation in the Central Filestore in Ivanti Avalanche 6.3.1 allows a remote authenticated att
• CVE-2024-36136 HIGH 7.5 DOWNGRADE DOWNGRADE An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to
• CVE-2024-13181 HIGH 7.3 UPGRADE Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass aut
• CVE-2024-13180 HIGH 7.5 UPGRADE Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensi
• CVE-2024-13179 HIGH 7.3 UPGRADE Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass aut
• CVE-2023-38036 CRITICAL 9.8 UPGRADE A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated att

FAQ

How do I fix avalanche vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is avalanche being exploited right now?

None of the tracked avalanche CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which avalanche CVE should I patch first?

CVE-2023-38036 currently ranks highest (61/100): A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated att.

RSS feed for avalanche · ← Back to latest CVEs