CVE-2022-36980

What it actually does

CVE-2022-36980 is an authentication bypass in Ivanti Avalanche 6.3.2.3490 affecting the EnterpriseServer service. The flaw is caused by improper locking during authentication operations, creating a race-condition-style weakness where carefully timed or concurrent requests can cause the service to treat an unauthenticated remote attacker as authenticated. Successful exploitation can give the attacker access to Avalanche management functionality, with potential confidentiality, integrity, and availability impact across managed mobile-device infrastructure.

Why it matters to the business

An attacker who reaches the Ivanti Avalanche EnterpriseServer service may be able to gain unauthorized administrative access without valid credentials. For organizations using Avalanche to manage rugged, mobile, warehouse, logistics, healthcare, or retail devices, this could allow theft of configuration data, disruption of device management, unauthorized policy changes, deployment of malicious configurations, or operational downtime. The EPSS score is high, indicating meaningful likelihood of exploitation activity despite the absence of CISA KEV listing or known ransomware association in the provided data.

How an attack unfolds

An attacker first identifies an exposed Ivanti Avalanche EnterpriseServer instance running the vulnerable 6.3.2.3490 release. Because the vulnerability is remotely reachable and does not require prior privileges, the attacker can interact directly with the authentication workflow. Exploitation requires high complexity because the attacker must trigger a timing or concurrency condition caused by missing locking during authentication. By sending carefully coordinated authentication-related requests, the attacker attempts to desynchronize or confuse the EnterpriseServer authentication state so that a session is created or accepted without valid credentials. Once an authenticated state is obtained, the attacker can access management functions, view or alter Avalanche-managed device configuration, make administrative changes, or use the platform as a foothold for further activity in the device-management environment.

How to fix it

Upgrade Ivanti Avalanche to a vendor-supported fixed release that addresses this authentication bypass; if exact fixed versions are not tracked internally, consult the current Ivanti Avalanche security advisory and release notes and move off version 6.3.2.3490. Until upgraded, restrict EnterpriseServer access to trusted administrative networks or VPN-only access, block direct internet exposure, enforce network segmentation around mobile-device-management infrastructure, and monitor or rate-limit abnormal authentication bursts where feasible. Review administrative accounts, roles, device policies, and recent configuration changes after remediation because password changes alone do not fully mitigate an authentication bypass.

How to confirm the fix worked

Confirm all Ivanti Avalanche deployments are no longer running version 6.3.2.3490 and are on a vendor-supported fixed build. Validate that EnterpriseServer management interfaces are not exposed to untrusted networks. Review firewall, load balancer, and vulnerability scanner results to confirm only intended administrative sources can reach the service. Where authorized, perform controlled security testing against a non-production or approved production window to confirm authentication cannot be bypassed through concurrent login/session attempts. Verify that logs show normal authentication sequencing and that no unexplained authenticated sessions or administrative actions occurred before the fix was applied.

Typical attack path

1. Identify internet-facing or internally reachable Ivanti Avalanche EnterpriseServer services.
2. Fingerprint the product and version to determine whether the deployment is consistent with Ivanti Avalanche 6.3.2.3490.
3. Send repeated or concurrent authentication/session-related requests to trigger the improper-locking race condition.
4. Obtain an authenticated session or access path without supplying valid credentials.
5. Use Avalanche management functionality to enumerate configuration, users, devices, policies, or deployment packages.
6. Modify settings, policies, device configurations, or administrative state, or attempt lateral movement using information obtained from the management platform.

How to detect it

Review Ivanti Avalanche EnterpriseServer application logs, web or API access logs, Windows Event Logs, reverse proxy logs, firewall logs, VPN logs, and EDR telemetry for signs of authentication-state abuse. Look for bursts of simultaneous or near-simultaneous authentication requests from the same source, repeated failed authentication attempts followed immediately by successful access, sessions that perform administrative actions without a corresponding successful login event, and access from unusual IP addresses or user agents. Investigate any creation or modification of administrative users, roles, device groups, packages, enrollment settings, certificates, device policies, or deployment jobs shortly after suspicious authentication activity. Because exploitation depends on timing and may not leave a unique payload artifact, detection should focus on behavioral anomalies around EnterpriseServer authentication and unexpected privileged actions.

• EnterpriseServer
• EnterpriseServer.exe
• Ivanti Avalanche
• Wavelink Avalanche
• C:\Program Files\Wavelink\Avalanche\
• C:\Program Files (x86)\Wavelink\Avalanche\
• C:\Program Files\Ivanti\Avalanche\
• C:\Program Files (x86)\Ivanti\Avalanche\

What your security team should do

• Prioritize upgrade or compensating isolation because the vulnerability has a high CVSS score and high EPSS probability despite not being listed in CISA KEV.
• Inventory all Ivanti Avalanche instances and specifically identify deployments running 6.3.2.3490.
• Remove internet exposure for EnterpriseServer and restrict access to trusted administrative networks or VPNs.
• After patching, review Avalanche users, roles, device groups, packages, policies, and recent configuration changes for unauthorized modifications.
• Hunt historical logs for abnormal bursts of authentication attempts, failed-then-successful access patterns, and administrative activity from unusual IP addresses.
• Add SIEM detections for authentication anomalies against Avalanche EnterpriseServer, especially high-concurrency login/session activity followed by privileged actions.
• Preserve relevant Avalanche application logs, Windows Event Logs, proxy logs, firewall logs, and EDR telemetry before log rotation removes evidence.