What is the CVSS score of CVE-2023-38036?

CVE-2023-38036 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.2%.

Which versions of Avalanche are affected by CVE-2023-38036?

CVE-2023-38036 is a critical unauthenticated remote code execution vulnerability affecting Ivanti Avalanche Manager versions prior to 6.4.1, allowing attackers to compromise affected systems without…. A patch is available.

How to fix or mitigate CVE-2023-38036?

Within 24 hours: Identify all Avalanche Manager instances and document current versions in your environment. Within 7 days: Upgrade all Avalanche Manager deployments to version 6.4.1 or later per Ivanti's security advisory; if immediate patching is infeasible, implement network-level access controls to restrict access to Avalanche Manager ports. Within 30 days: Conduct post-patch validation testing and review logs for indicators of exploitation attempts during the exposure window.

Avalanche CVE-2023-38036

EUVD-2023-41863 CRITICAL

Classic Buffer Overflow (CWE-120)

2025-07-12 support@hackerone.com

RCE Buffer Overflow Ivanti Denial Of Service Avalanche

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:51 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.4.1

EUVD ID Assigned

Mar 16, 2026 - 08:56 euvd

EUVD-2023-41863

Analysis Generated

Mar 16, 2026 - 08:56 vuln.today

CVE Published

Jul 12, 2025 - 04:15 nvd

CRITICAL 9.8

DescriptionCVE.org

A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to create a buffer overflow that could result in service disruption or arbitrary code execution.

AnalysisAI

CVE-2023-38036 is a critical unauthenticated buffer overflow vulnerability in Ivanti Avalanche Manager prior to version 6.4.1 that allows remote attackers to cause denial of service or achieve arbitrary code execution without authentication. With a CVSS score of 9.8 and network-based attack vector, this vulnerability has significant real-world exploitability risk and affects all organizations deploying vulnerable Avalanche Manager instances.

Technical ContextAI

The vulnerability exists in Ivanti Avalanche Manager, a mobile device management (MDM) and endpoint management solution. The root cause is classified as CWE-120 (Buffer Copy without Checking Size of Input, classic buffer overflow), indicating that the application fails to properly validate input size before copying data into a fixed-size buffer. This is a stack or heap-based buffer overflow vulnerability likely triggered through network input to a management service endpoint. The affected product line manages enterprise mobile and desktop devices, making the management interface itself a high-value attack target. Versions before 6.4.1 contain the vulnerable code path; the vulnerability is network-accessible (AV:N) with no authentication required (PR:N) and no user interaction needed (UI:N), indicating the flaw likely exists in an unauthenticated service endpoint or protocol handler.