CVE-2018-6635: Avaya Aura

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

System Manager in Avaya Aura before 7.1.2 does not properly use SSL in conjunction with authentication, which allows remote attackers to bypass intended Remote Method Invocation (RMI) restrictions, aka SMGR-26896.

Affected products

• Avaya Aura: up to and including 7.1.1

Published 2018-02-05. Last modified 2026-06-17.