CVE-2023-38036: Ivanti Avalanche

Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days.

A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to create a buffer overflow that could result in service disruption or arbitrary code execution.

Affected products

• Ivanti Avalanche: before 6.4.1 (fixed in 6.4.1)

Published 2025-07-12. Last modified 2026-06-17.