{"id":"CVE-2023-32563","published":"2023-08-10T19:04:48Z","modified":"2025-02-13T16:54:49Z","title":"An unauthenticated attacker could achieve the code execution through a RemoteControl server","vendor":"Ivanti","product":"Avalanche","tier":"core","eol":null,"affectedVersions":[{"vendor":"Ivanti","product":"Avalanche","versions":["all versions"]}],"description":{"text":"An unauthenticated attacker could achieve the code execution through a RemoteControl server.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw lies in the RemoteControl server component of Ivanti's Avalanche product. An unauthenticated attacker with adjacent network access can achieve code execution without user interaction, with no special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:16Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.89099,"percentile":0.99779,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-11-16","exploitedFirstSeen":"2023-11-16","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-16&host_type=src&vulnerability=cve-2023-32563","date":"2023-11-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-04&host_type=src&vulnerability=cve-2023-32563","date":"2023-12-04"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-10&host_type=src&vulnerability=cve-2023-32563","date":"2023-12-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-20&host_type=src&vulnerability=cve-2023-32563","date":"2023-12-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2023-32563","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-23&host_type=src&vulnerability=cve-2023-32563","date":"2024-01-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2023-32563","date":"2024-01-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-25&host_type=src&vulnerability=cve-2023-32563","date":"2024-01-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-26&host_type=src&vulnerability=cve-2023-32563","date":"2024-01-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-27&host_type=src&vulnerability=cve-2023-32563","date":"2024-01-27"}],"evidenceTotal":675,"provenance":"source"},"exploited":true,"otx":{"pulseCount":1,"pulses":[{"name":"Vulnerability_Exploitation_Public_Sources_Dec2023","url":"https://otx.alienvault.com/pulse/65926d953adb7c379a0aebc3","created":"2024-01-01"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US","tags":[]},{"url":"https://twitter.com/wvuuuuuuuuuuuuu/status/1694956245742923939","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-36807","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-36807","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2023-32563","name":"Ivanti Avalanche - Remote Code Execution","severity":"critical","path":"http/cves/2023/CVE-2023-32563.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-32563.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-08-10","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-32563","provenance":"source"},{"date":"2023-11-16","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-16&host_type=src&vulnerability=cve-2023-32563","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":66.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1080 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9978"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}