CVE-2025-8297
Published: 12 August 2025
Summary
CVE-2025-8297 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Ivanti Avalanche. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 5.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Ivanti Avalanche versions prior to 6.4.8.8008 contain an incomplete restriction of configuration that is tracked as CVE-2025-8297. The flaw is assigned CWE-434 and carries a CVSS 3.1 base score of 7.2, reflecting network-accessible attack vectors that require administrative credentials but no user interaction.
A remote attacker who already possesses valid administrator credentials can supply crafted configuration data to the affected server, resulting in arbitrary code execution on the underlying host. Successful exploitation grants the attacker full control over confidentiality, integrity, and availability of the Avalanche instance and any managed endpoints.
The vendor security advisory published at the referenced Ivanti forum URL addresses both CVE-2025-8297 and the related CVE-2025-8296, directing customers to upgrade to version 6.4.8.8008 or later. The EPSS score has remained flat at 0.1306 with no material increase observed since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-24258
Vulnerability details
Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to achieve remote code execution
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.