CVE-2024-24994: Ivanti Avalanche path traversal allows SYSTEM command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote authenticated command execution as SYSTEM with a high EPSS score, though exploitation is not yet confirmed in KEV.

What it is

Ivanti Avalanche before 6.4.3 contains a path traversal flaw in a web component. An authenticated remote attacker can traverse paths to reach functionality that executes arbitrary commands with SYSTEM privileges. The vendor advisory confirms the issue is fixed in 6.4.3.

Impact

An attacker with valid credentials gains arbitrary command execution as SYSTEM on the Avalanche server, leading to full host compromise and potential lateral movement into managed mobile device infrastructure.

Attack surface

Reachable over the network through the Avalanche web component; the CVSS vector shows network access with low privileges required and no user interaction. Authentication is required, so the attacker needs a valid account.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware use is documented in the record, but EPSS is 0.68104 (99.3rd percentile), indicating a high modeled likelihood of exploitation.

What to do

• Upgrade Ivanti Avalanche to 6.4.3 or later per the vendor advisory.
• Restrict network access to the Avalanche web interface to trusted management networks.
• Review and minimize accounts with access to the Avalanche web console; enforce least privilege.
• Monitor for suspicious child processes spawned by the Avalanche web service.
• Apply the vendor's security hardening guidance for 6.4.3.

Detection

• Alert on path traversal sequences (../, encoded variants) in Avalanche web requests.
• Monitor Avalanche server process creation for unexpected command interpreters or system utilities.
• Audit authentication logs for anomalous or newly used accounts accessing the web component.
• Baseline and alert on file access outside expected Avalanche web directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.