CVE-2022-36981: Ivanti Avalanche path traversal in DeviceLogResource enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no privileges or user interaction required and an authentication bypass makes this a remotely exploitable RCE on an internet-facing management server.

What it is

Ivanti Avalanche 6.3.3.101 fails to validate a user-supplied path in the DeviceLogResource class, allowing path traversal that leads to remote code execution. The flaw is remotely reachable and, although authentication is nominally required, the existing authentication mechanism can be bypassed. It matters because an unauthenticated network attacker can run code as the service account on a critical management server.

Impact

An attacker gains arbitrary code execution in the context of the Avalanche service account, which can lead to full compromise of the management server and any managed devices it controls.

Attack surface

Reached over the network via the DeviceLogResource endpoint; the CVSS vector shows no privileges or user interaction required, and the description states the authentication mechanism can be bypassed, so no valid credentials are needed.

Exploitation

Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is very high at 0.834 (99.7th percentile), indicating strong likelihood of exploitation activity.

What to do

• Upgrade Ivanti Avalanche to 6.3.4 or later per the vendor release notes.
• Restrict network access to the Avalanche management interface to trusted hosts only.
• Run the Avalanche service under a least-privilege account to limit post-exploitation impact.
• Monitor and alert on anomalous file access or process creation by the Avalanche service account.

Detection

• Review Avalanche service account file access and process creation logs for unexpected paths or child processes.
• Inspect HTTP requests to DeviceLogResource endpoints for traversal sequences such as ../ or encoded variants.
• Correlate outbound connections or new processes spawned by the Avalanche service with known administrative activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.