CVE-2023-32560

What it actually does

CVE-2023-32560 is a remotely exploitable memory corruption vulnerability in Ivanti/Wavelink Avalanche Manager. An unauthenticated attacker can send a specially crafted network message to the Avalanche Manager service, causing a crash or potentially gaining control of execution flow and running arbitrary code in the context of the service. With CVSS 9.8, network reachability, no authentication requirement, and weaponized exploit maturity, this should be treated as a critical remote code execution risk.

Why it matters to the business

Successful exploitation can disrupt Avalanche-managed device operations and, in the worst case, allow attackers to compromise the Avalanche Manager server. Because Avalanche is commonly used to manage operational mobile and warehouse devices, compromise may affect device availability, software distribution, configuration management, and broader enterprise operations. The EPSS score is extremely high, the issue has been public for a long time, and exploit code is weaponized, so internet-exposed or broadly reachable Avalanche Manager deployments carry significant operational and security risk even though the CVE is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies a reachable Ivanti/Wavelink Avalanche Manager instance. They then send a malformed or specially crafted message to the vulnerable Manager component. The message triggers memory corruption during message handling. Depending on the exploit path and target conditions, this may crash the service, causing denial of service, or allow the attacker to execute arbitrary code under the service account. After code execution, the attacker may deploy tooling, create persistence, access Avalanche-managed device data or configuration, pivot to adjacent systems, and use the server as a foothold in the environment.

How to fix it

Upgrade Ivanti/Wavelink Avalanche Manager to version 6.4.1 or later, which contains the vendor fix. If immediate upgrade is not possible, restrict network access to Avalanche Manager services to trusted administrative and device-management networks only, block internet exposure, enforce host-based firewall rules, monitor for crashes and unexpected child processes, and place compensating controls such as VPN, segmentation, and intrusion prevention in front of the service. Because the vulnerability is unauthenticated and weaponized, mitigation should be considered temporary and patching should be prioritized.

How to confirm the fix worked

Confirm the installed Avalanche Manager version is 6.4.1 or later using the product console, package inventory, or file/version metadata. Run an authenticated vulnerability scan or configuration audit to verify no vulnerable Avalanche Manager instances remain. Validate that Avalanche Manager ports are not reachable from the internet or untrusted network segments. Review firewall and access-control rules to ensure only required management and device subnets can communicate with the Manager service. After patching, confirm the service is stable, managed devices continue to check in normally, and no unexpected Avalanche service crashes occur.

Typical attack path

1. Scan for externally exposed or internally reachable Ivanti/Wavelink Avalanche Manager services.
2. Confirm the target appears to be running a vulnerable pre-6.4.1 version.
3. Send a crafted network message to the Avalanche Manager service.
4. Trigger memory corruption, causing either service crash or remote code execution.
5. If code execution succeeds, run commands under the Avalanche Manager service context.
6. Establish persistence, collect configuration or credential material, and attempt lateral movement.
7. Optionally disrupt Avalanche services to impair device management and delay response.

How to detect it

Review Avalanche Manager application logs, service logs, Windows Application and System Event Logs, Windows Error Reporting entries, EDR process telemetry, firewall logs, and network flow records. Look for unexplained Avalanche Manager crashes, access-violation or memory-corruption errors, repeated service restarts, malformed inbound connection attempts, and suspicious activity immediately following inbound traffic to the Manager service. Pay particular attention to unexpected child processes spawned by Avalanche-related services, such as command shells, PowerShell, scripting engines, archive tools, download utilities, or remote access tools. Investigate new files written to temporary, application, or startup directories around the time of crashes. Also review outbound connections from the Avalanche Manager server to unfamiliar external IPs, newly created local users, credential-dumping alerts, and lateral movement activity after any suspected exploit attempt.

What your security team should do

• Prioritize emergency upgrade of all Ivanti/Wavelink Avalanche Manager servers to version 6.4.1 or later.
• Immediately remove Avalanche Manager from direct internet exposure and restrict access to trusted networks.
• Inventory all Avalanche deployments, including lab, disaster recovery, and legacy management servers.
• Hunt for exploitation signs before and after patching, especially service crashes, abnormal process creation, and suspicious inbound traffic to Avalanche Manager services.
• Review EDR telemetry for command shells, scripting engines, or file-transfer tools spawned by Avalanche-related services.
• Collect and preserve Avalanche logs, Windows Event Logs, crash dumps, and relevant network telemetry for forensic review if suspicious activity is found.
• Rotate credentials or secrets stored on or accessible from the Avalanche Manager server if compromise is suspected.
• Add SIEM detections for repeated Avalanche Manager crashes, unexpected service restarts, and unusual outbound connections from the server.