CVE-2023-46264: Ivanti Avalanche Unrestricted File Upload Enables Remote Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication, and high EPSS make this an urgent remote code execution risk for exposed Avalanche servers.

What it is

Ivanti Avalanche versions 6.4.1 and below contain an unrestricted upload of file with dangerous type (CWE-434), allowing an attacker to upload a malicious file that can lead to remote code execution. The flaw is remotely reachable with no authentication or user interaction required, making it a severe risk for exposed deployments.

Impact

An unauthenticated attacker can execute arbitrary code on the affected Avalanche server, potentially gaining full control of the host and any data or services it manages.

Attack surface

The vulnerability is network-reachable (AV:N) with low attack complexity, no privileges required, and no user interaction, so any exposed Avalanche instance can be targeted directly.

Exploitation

The CVE is not listed in CISA KEV and no ransomware use is documented, but EPSS is very high (0.9019, 99.79th percentile), indicating a strong likelihood of exploitation activity.

What to do

• Upgrade to Avalanche 6.4.2 or later as indicated by the vendor release notes.
• Restrict network access to Avalanche management interfaces to trusted hosts or VPNs.
• Enforce file type validation and block executable extensions at upload endpoints if the product allows configuration.
• Monitor for and remove any unauthorized files uploaded to Avalanche directories.
• Apply vendor guidance from the 6.4.2 release notes for any additional hardening steps.

Detection

• Monitor Avalanche upload directories for newly created executable or script files (e.g., .exe, .dll, .jsp, .war).
• Alert on HTTP POST requests to Avalanche upload endpoints from unexpected source IPs or with suspicious file extensions.
• Review web server and application logs for upload activity followed by process creation or outbound connections from the Avalanche host.
• Use file integrity monitoring on Avalanche installation and data directories to detect unauthorized file changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.