CVE-2022-36980: Ivanti Avalanche EnterpriseServer authentication bypass via TOCTOU race

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 8.1 with no privileges or user interaction required and a very high EPSS score, though exploitation requires winning a race condition and no KEV or ransomware activity is documented.

What it is

Ivanti Avalanche 6.3.2.3490 contains an authentication bypass in the EnterpriseServer service caused by a time-of-check time-of-use race condition (CWE-367) from improper locking during authentication operations. A remote attacker can exploit the race to bypass the authentication mechanism entirely, gaining access to the system without valid credentials.

Impact

An attacker gains authenticated access to the Avalanche EnterpriseServer without valid credentials, with high impact to confidentiality, integrity and availability per the CVSS vector. This can expose managed mobile device data and allow further actions within the Avalanche environment.

Attack surface

Reachable over the network via the EnterpriseServer service (AV:N) with no user interaction (UI:N) and no privileges required (PR:N), though the attack complexity is rated high (AC:H) because the race condition must be won.

Exploitation

Not listed in CISA KEV and no ransomware usage documented; EPSS is very high at 0.831 (99.7th percentile), indicating strong predicted likelihood of exploitation, and the ZDI advisory reference confirms the flaw was reported through the ZDI program.

What to do

• Upgrade Ivanti Avalanche to 6.3.4 or later per the vendor release notes, which address this flaw.
• If immediate patching is not possible, restrict network access to the EnterpriseServer service to trusted management networks only.
• Monitor and log authentication attempts against EnterpriseServer for anomalies and repeated race-window probing.
• Review accounts and sessions on Avalanche servers for signs of unauthorized authenticated access.
• Track vendor advisories for any further updates or backports covering this issue.

Detection

• Alert on authentication events for EnterpriseServer that succeed without a corresponding valid credential exchange or that show unusual timing patterns.
• Correlate repeated rapid authentication requests from a single source against the EnterpriseServer port, which may indicate race-condition attempts.
• Audit Avalanche server logs for sessions established from unexpected source IPs or at unusual times.
• Use network monitoring to detect unexpected external connections to the EnterpriseServer service.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.