CVE-2025-8296 — Ivanti / Avalanche

CVE-2025-8296

Ivanti / Avalanche PUBLISHED

Description (CNA)

SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to execute arbitrary SQL queries. In certain conditions, this can also lead to remote code execution

Affected (CNA)

Vendor / product	Versions
Ivanti / Avalanche	unaffected 6.4.8.8008

CWE

CWE-89

References

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-CVE-2025-8296-CVE-2025-8297?language=en_US

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.