CVE-2023-32560: Ivanti Avalanche

Critical severity, CVSS 9.8. EPSS: 99.4% chance of exploitation in the next 30 days.

An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution. Thanks to a Researcher at Tenable for finding and reporting. Fixed in version 6.4.1.

Affected products

• Ivanti Avalanche: before 6.4.1 (fixed in 6.4.1)

Published 2023-08-10. Last modified 2026-06-17.