CVE

CVE-2024-38653

7.5

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

avalanche

Updated Nov 7, 2026View on NVD →

This CVE is in S4E's catalog, but no public scanner is mapped to it yet.

CVE history: avalanche

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.