CVE-2022-36974
RCE in Ivanti Avalanche 6.3.2.3490 – 6.3.4
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2022-36974 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Ivanti Avalanche. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
This vulnerability affects Ivanti Avalanche version 6.3.2.3490 and resides in the Web File Server service. It stems from insufficient validation of user-supplied data that permits deserialization of untrusted content, ultimately enabling remote code execution. Although the flaw requires authentication, the existing mechanism can be bypassed, and the issue is tracked as ZDI-CAN-15330 with a CVSS score of 9.8 and CWE-502.
An unauthenticated remote attacker can exploit the flaw by sending crafted serialized data to the service. Successful exploitation grants arbitrary code execution in the context of the service account, allowing full compromise of the affected installation without user interaction.
Public advisories from the Zero Day Initiative and the vendor release notes for Avalanche 6.3.4 indicate that upgrading to version 6.3.4 resolves the issue. The EPSS score has remained at 0.54 from its observed peak, indicating sustained but not newly emerging exploitation interest.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-39631
Vulnerability Data
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Web File Server…
more
service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15330.
- CWE(s)
Related Threats
Likely ATT&CK TechniquesAI
Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of user-supplied data before deserialization, blocking the untrusted serialized payload that enables RCE.
Mandates timely flaw remediation (patch to 6.3.4) to eliminate the deserialization vulnerability in the Web File Server service.
Enforces access-control decisions to stop authentication bypass that would otherwise allow an attacker to reach the deserialization flaw.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.PS-02 addresses only post-deployment updates/patching and cannot prevent introduction of unsafe deserialization code, yet it can remediate some instances when the flaw exists in outdated libraries or components.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing includes validation of deserialization routines and the use of untrusted data, reducing the likelihood that unsafe object reconstruction will be deployed.
Requiring vetted libraries, regular updates and SAST before release reduces the likelihood that deserialization logic will accept and act on attacker-controlled serialized objects.
Regular scanning of third-party libraries and timely patching reduce the likelihood that unsafe deserialization vulnerabilities remain active.
Mandatory malware scanning of data received over networks or storage media intercepts malicious serialized payloads before they are deserialized by the target application.