CVE-2021-42129: Ivanti Avalanche Inforail Service command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityNetwork-reachable command injection with full impact and a very high EPSS score, though exploitation requires authenticated access and no KEV listing exists.

What it is

Ivanti Avalanche before 6.3.3 contains a command injection flaw in the Inforail Service that lets an authenticated attacker execute arbitrary commands on the host. Because the service is network-reachable and the flaw yields full confidentiality, integrity and availability impact, it is a serious risk for exposed Avalanche deployments.

Impact

An attacker with access to the Inforail Service can run arbitrary operating system commands, leading to full compromise of the affected server and any data or downstream systems it manages.

Attack surface

Reached over the network via the Inforail Service; the CVSS vector (AV:N/PR:L/UI:N) indicates a low-privileged authenticated attacker is required and no user interaction is needed.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware association is recorded in the references, but EPSS is very high (0.77259, 99.53rd percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade Ivanti Avalanche to 6.3.3 or later per the vendor security alert.
• Restrict network access to the Inforail Service to trusted hosts and segments.
• Enforce least privilege and strong authentication for Avalanche service accounts.
• Monitor and alert on unexpected child processes or command execution spawned by Avalanche services.
• Review logs for anomalous Inforail Service activity and apply vendor hardening guidance.

Detection

• Monitor Avalanche/Inforail Service processes for spawning of shells or system utilities (cmd.exe, powershell, /bin/sh).
• Alert on unusual outbound connections or file writes originating from the Avalanche server.
• Audit authentication and access logs to the Inforail Service for unexpected or low-privileged accounts.
• Use EDR to flag command-line arguments passed to Avalanche service processes that match injection patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.