CVE-2022-36977
published 2023-03-29CVE-2022-36977: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is…
PriorityP270critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
6.71%
93.1th percentile
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Certificate Management Server service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15449.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ivanti | avalanche | — | — |
| ivanti | avalanche | >= 6.3.2.3490 < 6.3.4 | 6.3.4 |
Detection & IOCsextracted from sources · hover to see the quote
- →Target service for exploitation is the Certificate Management Server service within Ivanti Avalanche; monitor for anomalous process execution or deserialization activity originating from this service's process/account context. ↗
- →Authentication bypass precedes exploitation; alert on unexpected or anomalous authenticated sessions to the Certificate Management Server service on Ivanti Avalanche 6.3.2.3490, particularly where authentication succeeds without valid credentials. ↗
- ·Vulnerability is confirmed on Ivanti Avalanche version 6.3.2.3490 specifically; scope of affected versions beyond this is not stated in the source. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Ivanti Avalanche 6.3.2.3490 deserialization (ZDI-22-782 / EUVD-2022-39634)
vuldb·2026-06-18·CVSS 9.8
CVE-2022-36977 [CRITICAL] Ivanti Avalanche 6.3.2.3490 deserialization (ZDI-22-782 / EUVD-2022-39634)
A vulnerability identified as critical has been detected in Ivanti Avalanche 6.3.2.3490. The affected element is an unknown function. This manipulation causes deserialization.
This vulnerability is tracked as CVE-2022-36977. The attack is possible to be carried out remotely. No exploit exists.
You should upgrade the affected component.
GHSA
GHSA-2rjc-h554-j93w: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6
ghsa_unreviewed·2023-03-29
CVE-2022-36977 [CRITICAL] CWE-502 GHSA-2rjc-h554-j93w: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Certificate Management Server service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15449.
Ivanti
Ivanti Security Advisory: CVE-2022-36977
vendor_ivanti·2023-03-29·CVSS 9.8
CVE-2022-36977 [CRITICAL] CWE-502 Ivanti Security Advisory: CVE-2022-36977
Ivanti Security Advisory: CVE-2022-36977
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Certificate Management Server service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15449.
CVE IDs: CVE-2022-36977
CVSS Base Score: 9.8
Severity: CRITICAL
CWEs: CWE-502
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-03-29
Published