CVE-2022-36982: Ivanti Avalanche path traversal allows arbitrary file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityHigh CVSS (7.5) with authentication bypass and arbitrary file read, plus very high EPSS, though no KEV listing or documented ransomware use.

What it is

Ivanti Avalanche 6.3.3.101 contains a path traversal flaw in the AgentTaskHandler class, where a user-supplied path is used in file operations without proper validation. An attacker can bypass the existing authentication mechanism, so the flaw is reachable without valid credentials. Successful exploitation discloses stored session cookies, which can be used to further compromise the system.

Impact

An attacker gains read access to arbitrary files on the server, including stored session cookies. Those cookies can be reused to hijack authenticated sessions and escalate to broader compromise.

Attack surface

Reachable over the network via the AgentTaskHandler component; the CVSS vector shows no privileges or user interaction required, and the description states the existing authentication can be bypassed. No local access or victim action is needed.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high at 0.73757 (99.45th percentile), indicating strong likelihood of exploitation activity. References are limited to vendor release notes and the ZDI advisory, with no public exploit tag.

What to do

• Upgrade Ivanti Avalanche to 6.3.4 or later, which the vendor release notes identify as the fixed version.
• If immediate patching is not possible, restrict network access to the Avalanche management/agent interfaces to trusted hosts only.
• Invalidate and rotate stored session cookies and credentials that may have been exposed.
• Monitor and review authentication bypass attempts against the AgentTaskHandler endpoint.
• Apply least-privilege permissions to the Avalanche service account to limit file read scope.

Detection

• Monitor for path traversal patterns such as ../ or encoded variants in requests to Avalanche AgentTaskHandler endpoints.
• Alert on unexpected reads of files outside expected application directories by the Avalanche service process.
• Review web/proxy logs for anomalous file retrieval requests from unauthenticated or unexpected source IPs.
• Track session cookie reuse from IPs or user agents inconsistent with the original session.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.