CVE-2024-24992: Ivanti Avalanche path traversal allows SYSTEM command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote authenticated path traversal leading to SYSTEM command execution with a high EPSS score, though not in KEV and requiring valid credentials.

What it is

Ivanti Avalanche before 6.4.3 contains a path traversal flaw in a web component (CWE-22). A remote authenticated attacker can abuse it to execute arbitrary commands with SYSTEM privileges. The record does not list specific affected builds beyond the pre-6.4.3 range.

Impact

An attacker with valid credentials gains arbitrary command execution as SYSTEM on the Avalanche server, effectively full control of the host. That enables data theft, service disruption, and further lateral movement.

Attack surface

Reachable over the network through the Avalanche web component (CVSS AV:N). Authentication is required (PR:L) and no user interaction is needed (UI:N).

Exploitation

Not listed in CISA KEV and no ransomware use documented. EPSS is high at 0.709 (99.4th percentile), indicating elevated likelihood of exploitation, but the record contains no public exploit reference.

What to do

• Upgrade Ivanti Avalanche to 6.4.3 or later per the vendor advisory.
• Restrict network access to the Avalanche web interface to trusted management networks.
• Enforce least privilege and strong authentication for Avalanche accounts; audit and remove unused accounts.
• Monitor and limit the service account rights available to the Avalanche web component.
• Review logs for traversal patterns and unexpected child processes spawned by Avalanche services.

Detection

• Alert on path traversal sequences (../, encoded variants) in HTTP requests to Avalanche web endpoints.
• Monitor for Avalanche service processes spawning cmd.exe, powershell.exe, or other unexpected child processes.
• Baseline and alert on file writes or reads outside expected Avalanche directories.
• Correlate authenticated Avalanche sessions with anomalous command execution or SYSTEM-level process creation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.