PatchTheCVEavaya vulnerabilities
Recent CVEs affecting avaya products. 9 tracked.
avaya has 9 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 6. Most recent: 2025-06-12. Highest priority: CVE-2024-4196 (score 52/100).
- CVE-2025-49186 MEDIUM 5.3 MITIGATE MITIGATE The product does not implement sufficient measures to prevent multiple failed authentication attempts within a
- CVE-2025-1041 CRITICAL 9.9 UPGRADE An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote
- CVE-2024-7480 MEDIUM 4.2 UPGRADE An Improper access control vulnerability was found in Avaya Aura System Manager which could allow a command-li
- CVE-2024-7477 MEDIUM 6.5 UPGRADE A SQL injection vulnerability was found which could allow a command line interface (CLI) user with administrat
- CVE-2024-4197 CRITICAL 9.9 UPGRADE An unrestricted file upload vulnerability in Avaya IP Office was discovered that could allow remote command or
- CVE-2024-4196 CRITICAL 10.0 UPGRADE An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command
- CVE-2024-12756 HIGH 7.3 MITIGATE An HTML Injection vulnerability in Avaya Spaces may have allowed disclosure of sensitive information or modifi
- CVE-2024-12755 HIGH 7.9 MITIGATE A Cross-Site Scripting (XSS) vulnerability in Avaya Spaces may have allowed unauthorized code execution and po
- CVE-2023-7031 MEDIUM 5.7 UPGRADE Insecure Direct Object Reference vulnerabilities were discovered in the Avaya Aura Experience Portal Manager w
FAQ
How do I fix avaya vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is avaya being exploited right now?
None of the tracked avaya CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which avaya CVE should I patch first?
CVE-2024-4196 currently ranks highest (52/100): An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command .