CVE-2023-32563: Ivanti Avalanche path traversal enables unauthenticated code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityUnauthenticated remote code execution with a 9.8 CVSS score and near-maximum EPSS probability makes this an urgent patching priority despite no KEV listing.

What it is

CVE-2023-32563 is a path traversal (CWE-22) flaw in Ivanti Avalanche that an unauthenticated attacker can use to achieve code execution through a RemoteControl server. With a CVSS 3.1 score of 9.8 and an EPSS 30-day probability near 0.89, it is a high-value target for remote compromise of exposed Avalanche deployments.

Impact

An attacker gains remote code execution on the affected Avalanche server without credentials, which can lead to full compromise of the host and any data or managed devices it controls.

Attack surface

Reachable over the network via the RemoteControl server component; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but the very high EPSS score (0.99771 percentile) signals strong likelihood of exploitation; references are limited to a vendor advisory and a tweet, with no public exploit details in the record.

What to do

• Apply the Ivanti Avalanche 6.4.1 update referenced in the vendor advisory as the primary fix.
• Restrict network access to Avalanche RemoteControl server ports to trusted management networks only.
• Place Avalanche servers behind a firewall or VPN and avoid direct internet exposure.
• Monitor vendor advisories for follow-up patches or updated guidance on this CVE.
• If patching is delayed, isolate affected servers and limit their reachable services.

Detection

• Review Avalanche and web server logs for path traversal patterns such as ../ sequences targeting RemoteControl endpoints.
• Alert on unexpected child processes or command execution spawned by Avalanche services.
• Monitor for anomalous outbound connections from Avalanche hosts that could indicate post-exploitation activity.
• Audit file system changes in Avalanche directories for unauthorized writes or dropped payloads.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.