Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-8296

SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to execute arbitrary SQL queries. In certain conditions, this can also lead to remote code execution

Published

2025-08-12T15:15:31.610

Last Modified

2025-08-15T18:23:41.243

Status

Analyzed

Source

3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Severity

CVSSv3.1: 7.2 (HIGH)

Weaknesses

Type: Secondary
CWE-89

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	ivanti	avalanche	< 6.4.8.8008	Yes

References

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-CVE-2025-8296-CVE-2025-8297?language=en_US Vendor Advisory (3c1d8aa1-5a33-4ea4-8992-aadd6440af75)