CVE-2024-29848: Ivanti Avalanche unrestricted file upload leads to SYSTEM command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw gives authenticated privileged users SYSTEM-level remote code execution, and while no KEV listing or public exploit is confirmed, the high EPSS score and sensitive management-server role make it a serious patching priority.

What it is

Ivanti Avalanche before 6.4.x contains an unrestricted file upload flaw in a web component (CWE-434). An authenticated, privileged user can upload a file that is then executed, allowing arbitrary commands to run as SYSTEM. This matters because it converts a high-privilege web account into full control of the underlying host.

Impact

An attacker with valid privileged credentials gains remote code execution as SYSTEM on the Avalanche server. That yields complete compromise of the host, including data, configuration and any managed devices or downstream systems.

Attack surface

Reached over the network through the Avalanche web component (CVSS AV:N), requiring authentication and high privileges (PR:H) but no user interaction (UI:N). The description does not specify the exact endpoint or upload path.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented. EPSS is high (0.64423, 99.2nd percentile), and the only references are vendor advisories, so no public exploit code is confirmed by this record.

What to do

• Upgrade Ivanti Avalanche to 6.4.x or later, applying the vendor's May 2024 security advisory and 6.4.3.602 hardening release.
• Restrict and audit accounts with privileged access to the Avalanche web interface; enforce least privilege and remove unused admin accounts.
• Block or monitor uploads of executable file types through the Avalanche web component at the reverse proxy or WAF.
• Segment the Avalanche server so that SYSTEM-level compromise does not expose broader management or corporate networks.
• Review file upload directories for unexpected executables and validate file type/content on upload if the product allows configuration.

Detection

• Monitor Avalanche web logs for file upload requests, especially unusual file extensions or content types from privileged accounts.
• Alert on new executable files appearing in Avalanche web or upload directories, and on processes spawned by the Avalanche web service.
• Correlate privileged Avalanche account activity with child processes such as cmd.exe, powershell.exe or other command interpreters.
• Hunt for outbound connections or command execution originating from the Avalanche server shortly after upload events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.