CVE-2023-28128: Ivanti Avalanche unrestricted file upload leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityNetwork-reachable remote code execution with a very high EPSS score and public exploit references, though it requires high privileges and is not in KEV.

What it is

Ivanti Avalanche versions 6.3.x and below contain an unrestricted upload of a file with a dangerous type (CWE-434), reachable through the FileStoreConfig component. An attacker who can reach that upload path can place a malicious file and achieve remote code execution. The flaw matters because it gives code execution on a management product, and the record does not list fixed versions beyond the 6.3.x-and-below statement.

Impact

An attacker gains remote code execution on the affected Avalanche server, which can lead to full compromise of the host and any data or managed devices it controls.

Attack surface

The vector is network-reachable (AV:N) with no user interaction (UI:N), but requires high privileges (PR:H), so the attacker needs an authenticated administrative-level account or equivalent access to the upload function.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high (0.847, 99.7th percentile), and public proof-of-concept material is referenced on Packet Storm, indicating active interest and likely exploitability.

What to do

• Apply the Ivanti Avalanche update that addresses the FileStoreConfig arbitrary file upload; check the vendor advisory for the fixed build since the record only states 6.3.x and below are affected.
• Restrict network access to the Avalanche management interface and upload endpoints to trusted administrative networks.
• Enforce least privilege and review accounts with high privileges that could reach the upload function.
• Block or monitor uploads of executable or script file types through the FileStoreConfig path.
• If patching is delayed, isolate the Avalanche server from untrusted networks and increase monitoring of file writes to web-accessible directories.

Detection

• Monitor for file uploads to Avalanche FileStoreConfig paths, especially files with executable, script or web-shell extensions.
• Alert on new or modified files in web-accessible directories on the Avalanche server.
• Review server and application logs for unexpected process execution or child processes spawned by the Avalanche service.
• Correlate high-privilege account activity with upload events and subsequent outbound connections from the Avalanche host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.