{"affected":[{"defaultStatus":"unaffected","product":"Avalanche","source":"CNA: hackerone","vendor":"Ivanti","versions":[{"lessThan":"6.4.1","status":"affected","version":"6.4.0","versionType":"custom"}]}],"cveId":"CVE-2023-38036","cwes":["CWE-120"],"description":"A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to create a buffer overflow that could result in service disruption or arbitrary code execution.","epss":{"date":"2026-11-03","percentile":0.86664,"score":0.02836},"exploits":[],"kev":null,"metrics":[{"score":9.8,"severity":"critical","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793742750879,"publishedAt":1752291040265,"references":[{"source":"CNA: hackerone","tags":[],"url":"https://forums.ivanti.com/s/article/Security-Advisory-Avalanche-CVE-2023-38036"}],"remediation":[],"revision":"29ca3d2d1770ed3415e1172d23eac6b0ba6135c8d2ebeee86eae1b75a9f67521","sources":[{"modifiedAt":1793742750879,"name":"CNA: hackerone","retrievedAt":1793743773052,"url":"https://www.cve.org/CVERecord?id=CVE-2023-38036"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793743804054,"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-38036"}],"ssvc":{"assessedAt":1752551710817,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"CVE-2023-38036","updatedAt":1793743804054}