CVE-2024-23535: Ivanti Avalanche path traversal allows SYSTEM command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote authenticated path traversal leading to SYSTEM command execution with a very high EPSS score, though it requires valid credentials and is not in KEV.

What it is

Ivanti Avalanche before 6.4.3 contains a path traversal flaw in a web component (CWE-22). A remote authenticated attacker can abuse it to execute arbitrary commands with SYSTEM privileges, making it a serious post-authentication compromise path on the management server.

Impact

An attacker with valid credentials gains arbitrary command execution as SYSTEM on the Avalanche server, effectively full control of that host and any data or downstream managed devices it administers.

Attack surface

Reachable over the network through the Avalanche web component (CVSS AV:N), requiring low-privileged authentication (PR:L) and no user interaction (UI:N).

Exploitation

Not listed in CISA KEV and no public exploit references are provided, but EPSS is high at roughly 0.68 (99th percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Upgrade Ivanti Avalanche to 6.4.3 or later per the vendor advisory.
• Restrict network access to the Avalanche web interface to trusted management networks.
• Enforce least privilege and strong authentication for Avalanche accounts; audit and remove unused accounts.
• Monitor and alert on anomalous child processes or command execution spawned by the Avalanche web service.
• Apply the vendor's 6.4.3 security hardening guidance in full.

Detection

• Review Avalanche web server logs for traversal sequences (../, encoded variants) in request paths.
• Alert on unexpected processes or command shells spawned by the Avalanche web service account.
• Baseline and monitor file access outside expected Avalanche web directories.
• Correlate authenticated web requests with subsequent SYSTEM-level process creation on the Avalanche host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.