CVE-2024-47011: Ivanti Avalanche path traversal allows unauthenticated information leak

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote information disclosure with a high EPSS score and no KEV listing, so it warrants prompt patching despite the absence of confirmed in-the-wild exploitation.

What it is

Ivanti Avalanche before version 6.4.5 contains a path traversal flaw (CWE-22) that lets a remote attacker read files outside the intended directory. Because the attacker needs no credentials, any network-reachable instance is exposed to sensitive information disclosure.

Impact

An attacker gains read access to sensitive files on the server, which can expose configuration data, credentials or other confidential information useful for follow-on attacks. The flaw affects confidentiality only; there is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable over the network via the affected Avalanche service; the CVSS vector shows no privileges required and no user interaction, so exploitation is unauthenticated and remote.

Exploitation

The record shows no CISA KEV listing and no public exploit references, but EPSS is high at roughly 0.56 (99th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade Ivanti Avalanche to version 6.4.5 or later as directed by the vendor advisory.
• Restrict network access to the Avalanche management interface to trusted hosts or internal segments.
• Place the service behind a reverse proxy or WAF with path traversal filtering where feasible.
• Audit file system permissions so the Avalanche service account cannot read unrelated sensitive files.
• Monitor vendor advisory for updated guidance if immediate patching is not possible.

Detection

• Inspect web and application logs for traversal sequences such as ../ or encoded variants in request paths.
• Alert on unexpected reads of files outside the Avalanche web root by the service account.
• Baseline normal request patterns and flag anomalous file-path parameters or high-volume enumeration attempts.
• Review outbound or file access activity from the Avalanche host for signs of data staging.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.