High severity8.8NVD Advisory· Published Apr 19, 2024· Updated Jun 17, 2026

CVE-2024-24992

Description

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.

Affected products

Ivanti/Avalanche3 versions
cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:ivanti:avalanche:*:*:*:*:*:*:*:*range: <6.4.3.528
- (no CPE)range: <6.4.3
- (no CPE)range: 6.4.3

Patches

Vulnerability mechanics

References

forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressednvdVendor Advisory
forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressednvdBroken Link

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.057
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000