CVE-2022-36980
Race Condition in Ivanti Avalanche 6.3.2.3490 – 6.3.4
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2022-36980 is a high-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Ivanti Avalanche. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-25 (Reference Monitor) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
This vulnerability is an authentication bypass flaw, tracked as CVE-2022-36980 and ZDI-CAN-15528, that affects Ivanti Avalanche version 6.3.2.3490. The issue resides in the EnterpriseServer service and stems from a race condition (CWE-367) caused by insufficient locking during authentication operations, allowing the existing authentication mechanism to be circumvented despite the requirement for initial credentials. It carries a CVSS 3.1 score of 8.1 with network attack vector and high impact on confidentiality, integrity, and availability.
Remote attackers can exploit the flaw without user interaction to bypass authentication entirely on affected installations. Successful exploitation grants the attacker the ability to perform unauthorized operations on the system as if valid credentials had been supplied.
The referenced advisories and release notes indicate that the issue is resolved in Avalanche 6.3.4. The EPSS score has remained flat at 0.1527 with no indicated rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-39637
Vulnerability Data
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the EnterpriseServer service. The issue…
more
results from the lack of proper locking when performing operations during authentication. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-15528.
- CWE(s)
Related Threats
Likely ATT&CK TechniquesAI
Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authenticated access decisions; the race condition allows the enforcement step to be bypassed during authentication in EnterpriseServer.
Requires a tamper-proof reference monitor for all access decisions, which would eliminate the TOCTOU flaw caused by missing locking.
Mandates reliable identification and authentication before granting access, directly addressing the mechanism that the race condition circumvents.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly include coding standards and reviews that prevent TOCTOU race conditions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Reliable, synchronized time across systems narrows the exploitable window in which a resource state can change between a security check and its use.