CVE-2021-22962: Ivanti Avalanche crafted request leaks data and causes DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCritical CVSS (9.1) with no authentication or interaction required and very high EPSS, though no confirmed in-the-wild exploitation is documented.

What it is

Ivanti Avalanche accepts a specially crafted request that can leak sensitive data or trigger a resource-based denial of service. The flaw is remotely reachable without authentication, and the vendor addressed it in the 6.4.2 release.

Impact

An unauthenticated attacker can read sensitive data exposed by the affected component and can exhaust resources to degrade or deny service.

Attack surface

Reachable over the network via a crafted request; the CVSS vector shows no privileges or user interaction required. The description does not identify the specific endpoint or protocol.

Exploitation

Not listed in CISA KEV and no public exploit tags appear in the references, but EPSS is very high (0.91, ~99.8th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade Ivanti Avalanche to version 6.4.2 or later per the vendor release notes.
• Restrict network access to Avalanche management and service interfaces to trusted hosts.
• Monitor and rate-limit request volume to reduce resource-exhaustion impact.
• Review logs for anomalous requests and data access patterns until patched.

Detection

• Alert on abnormal request rates or payload patterns against Avalanche endpoints.
• Monitor for unexpected outbound data transfers or large responses from Avalanche services.
• Track resource exhaustion indicators (CPU, memory, connection counts) on Avalanche hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.