CVE-2023-46263: Ivanti Avalanche unrestricted file upload enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction, and very high EPSS probability make this a top remediation priority.

What it is

Ivanti Avalanche versions 6.4.1 and below allow unrestricted upload of files with dangerous types. Because the upload is not restricted, an attacker can place executable content and achieve remote code execution. The flaw is rated critical with a CVSS of 9.8 and affects a network-reachable product.

Impact

An attacker can execute arbitrary code on the affected Avalanche server, leading to full compromise of confidentiality, integrity and availability. This can result in server takeover and further lateral movement within the managed environment.

Attack surface

The vulnerability is network reachable (AV:N) with low attack complexity and no privileges or user interaction required (PR:N, UI:N). No authentication is needed to reach the vulnerable upload functionality according to the CVSS vector.

Exploitation

The record does not list this CVE in CISA KEV and no ransomware usage is documented. EPSS is very high at 0.81884 (99.6th percentile), indicating a strong likelihood of exploitation activity, but no public exploit reference is provided.

What to do

• Upgrade Ivanti Avalanche to version 6.4.2 or later as indicated by the vendor release notes.
• If immediate upgrade is not possible, restrict network access to the Avalanche management interface to trusted hosts only.
• Enforce strict file type validation and block executable extensions at any upload endpoint if configuration allows.
• Monitor and alert on unexpected file writes or process creation from web-accessible directories on Avalanche servers.
• Apply the principle of least privilege to the service account running Avalanche to limit post-exploitation impact.

Detection

• Monitor for uploads of executable or script file types (e.g., .exe, .jsp, .war, .dll) to Avalanche web directories.
• Alert on child processes spawned by the Avalanche web service, especially command shells or scripting engines.
• Review web server logs for POST requests to upload endpoints with unusual file extensions or content types.
• Use file integrity monitoring on Avalanche installation and web root directories to detect new or modified executable files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.