{"id":"CVE-2022-36980","published":"2023-03-29T00:00:00Z","modified":"2025-02-18T19:50:52Z","title":"This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche…","vendor":"Ivanti","product":"Avalanche","tier":"core","eol":null,"affectedVersions":[{"vendor":"Ivanti","product":"Avalanche","versions":["6.3.2.3490"]}],"description":{"text":"This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the EnterpriseServer service. The issue results from the lack of proper locking when performing operations during authentication. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15528.","provenance":"source","from":"CVE.org"},"summary":{"text":"The authentication flaw in Ivanti Avalanche (version 6.3.2.3490) lies in the EnterpriseServer service, where a time-of-check/time-of-use race condition arises from missing locking during authentication operations. A remote attacker with network access and no privileges or user interaction can bypass the existing authentication mechanism on affected installations, which can lead to unauthorized access to the system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:14:48Z"},"cvss":{"score":9.4,"severity":"CRITICAL","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.82416,"percentile":0.99662,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-367","name":"Time-of-check Time-of-use (TOCTOU) Race Condition"}],"references":[{"url":"https://download.wavelink.com/Files/avalanche_v6.3.4_release_notes.txt","tags":[]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-22-785/","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-39637","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-39637","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-03-29","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-36980","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":26.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9966"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.58,"detail":"base score 9.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}