Cyber Resilience

CVE-2023-28126

Auth Bypass in Ivanti Avalanche ≤ 6.3.4.153

Published
09 May 2023
Modified
29 January 2025
Patch / advisory
CVSS Score v3.1 5.9
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.67 99.2th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2023-28126 is a medium-severity Authentication Bypass by Primary Weakness (CWE-305) vulnerability in Ivanti Avalanche. Its CVSS base score is 5.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploiting the SetUser method or can exploit the Race Condition in the authentication message.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-28125Same product: Ivanti Avalanche
CVE-2024-23531Same product: Ivanti Avalanche
CVE-2023-46262Same product: Ivanti Avalanche
CVE-2023-32563Same product: Ivanti Avalanche
CVE-2024-24999Same product: Ivanti Avalanche
CVE-2024-13180Same product: Ivanti Avalanche
CVE-2025-8296Same product: Ivanti Avalanche
CVE-2024-27976Same product: Ivanti Avalanche
CVE-2023-41474Same product: Ivanti Avalanche
CVE-2024-27977Same product: Ivanti Avalanche

Affected Assets

ivanti
avalanche
≤ 6.3.4.153

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 5 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V10.4.2
  • V6.4.3
  • V7.2.4
  • V10.4.5

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-362

Accurate timestamps from internal clocks enable detection of race conditions by providing reliable event ordering in audit logs.

addresses: CWE-362

Coordination of concurrent security activities reduces the probability that shared resources will be accessed simultaneously without proper synchronization.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure development practices throughout the SDLC prevent the primary weaknesses that enable authentication bypass.

PR.AA-03 mostly match
prevents

Strong authentication mechanisms and policy enforcement directly reduce bypass opportunities arising from implementation flaws.

ID.RA-01 partial match
prevents

Identifying and recording vulnerabilities catches the primary weaknesses that allow authentication bypass.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect authentication bypass conditions before deployment.

prevents

Secure development lifecycle reduces likelihood of introducing bypass flaws during implementation.

prevents

Application security requirements can specify thread-safety and locking rules, but do not prescribe implementation details.

prevents

Secure architecture principles require proper synchronization and resource isolation, addressing the root cause of CWE-362.

prevents

Secure coding practices help prevent the primary weakness that enables authentication bypass.

mitigates

Information access restriction complements authentication by limiting what can be reached even if bypass occurs.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

Ubuntu 22.04 (1 rule)
  • V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. prevents CWE-305
Ubuntu 24.04 (1 rule)
  • V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. prevents CWE-305

References