CVE-2022-36974: Ivanti Avalanche Web File Server deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, authentication bypass and code execution impact, plus an EPSS near the top percentile, makes this a critical patching priority despite no KEV listing.

What it is

Ivanti Avalanche 6.3.2.3490 contains a deserialization of untrusted data flaw in the Web File Server service, caused by missing validation of user-supplied data. Authentication is required but the existing authentication mechanism can be bypassed, so the flaw is effectively reachable by remote unauthenticated attackers. It matters because successful exploitation yields code execution in the service account context on a critical management product.

Impact

An attacker gains arbitrary code execution with the privileges of the service account on the affected Avalanche installation. That level of access can be used to compromise the host and pivot into the managed mobile device estate.

Attack surface

Reached remotely over the network through the Web File Server service; the CVSS vector is AV:N/AC:L/PR:N/UI:N, and the description states authentication is required but bypassable, so no valid credentials or user interaction are needed in practice.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high at 0.84454 (99.688th percentile), indicating strong likelihood of attempted exploitation. References are release notes and the ZDI advisory only, with no public exploit tag.

What to do

• Upgrade Ivanti Avalanche to 6.3.4 or later per the vendor release notes, which is the only fix referenced.
• If immediate upgrade is not possible, restrict network access to the Web File Server service to trusted management networks only.
• Run the Avalanche service under a least-privileged account to limit the impact of code execution.
• Monitor vendor advisories for further guidance and confirm no other exposed Avalanche services remain reachable.
• Treat any internet-facing Avalanche instance as high risk and isolate it until patched.

Detection

• Hunt for unexpected child processes spawned by the Avalanche Web File Server service account.
• Monitor for suspicious deserialization or file upload activity against the Web File Server endpoints.
• Alert on outbound network connections from the Avalanche host to unfamiliar destinations.
• Review service account activity for command execution or file writes outside normal application paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.