CVE-2023-32560: Ivanti Avalanche Manager out-of-bounds write allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, and high EPSS indicate a severe, likely exploitable remote code execution flaw in a management server.

What it is

Ivanti Avalanche Manager fails to properly validate specially crafted messages, leading to an out-of-bounds write (CWE-787) and improper input validation (CWE-20). A remote, unauthenticated attacker can trigger service disruption or arbitrary code execution. The flaw is fixed in version 6.4.1.

Impact

An attacker can crash the Avalanche Manager service or execute arbitrary code in its context, potentially compromising the management server and managed devices.

Attack surface

Reachable over the network via a crafted message to the Avalanche Manager service; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high (0.99428, 99.94th percentile) and public Packet Storm references describe remote code execution and buffer overflow, indicating mature public exploit material.

What to do

• Upgrade Ivanti Avalanche Manager to version 6.4.1 or later immediately.
• If patching cannot be done at once, restrict network access to the Avalanche Manager service to trusted management networks only.
• Monitor vendor advisory and Packet Storm references for updated guidance and any interim mitigations.
• Segment Avalanche Manager from general user networks to limit lateral movement if it is compromised.
• Verify the patch level of all Avalanche components, not just the Manager, after upgrading.

Detection

• Monitor Avalanche Manager service logs for crashes, restarts, or abnormal termination events.
• Inspect network traffic to the Avalanche Manager port for malformed or unusually large messages.
• Alert on unexpected child processes or command execution originating from the Avalanche Manager service account.
• Correlate host-based indicators of memory corruption (e.g., access violations) in Avalanche Manager processes with inbound network connections.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.