CVE-2021-42131: Ivanti Avalanche Inforail Service SQL Injection Privilege Escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityNetwork-reachable SQL injection with high impact and a very high EPSS score, though it requires low privileges and no confirmed exploitation.

What it is

Ivanti Avalanche before 6.3.3 contains a SQL injection flaw in the Inforail Service. An attacker who can reach that service can inject SQL to escalate privileges. The vendor advisory confirms the issue is fixed in 6.3.3.

Impact

An attacker gains the ability to execute arbitrary SQL against the backend database, which the record states leads to privilege escalation. Given the CVSS impact ratings of high confidentiality, integrity and availability, this can expose or alter data and disrupt the service.

Attack surface

The vector is network reachable (AV:N) with low attack complexity and no user interaction. It requires low privileges (PR:L), meaning the attacker needs some existing access to the Inforail Service rather than being fully unauthenticated.

Exploitation

The record is not listed in CISA KEV and no public exploit or ransomware use is documented. EPSS is high at roughly 0.665 (99.2nd percentile), indicating elevated predicted exploitation likelihood, but this is a model estimate, not confirmed exploitation.

What to do

• Upgrade Ivanti Avalanche to 6.3.3 or later, per the vendor security alert.
• Restrict network access to the Inforail Service to trusted hosts and segments.
• Apply least privilege to accounts that can reach the service and to the database account it uses.
• Review database and service logs for anomalous SQL activity and unexpected privilege changes.
• Monitor the vendor advisory for any further guidance or updated fixed versions.

Detection

• Inspect Inforail Service and database logs for SQL syntax errors, UNION statements, or stacked queries.
• Alert on unexpected privilege or role changes for accounts tied to Avalanche.
• Baseline and monitor network connections to the Inforail Service port for unusual sources.
• Correlate service account activity with database queries that touch authentication or permission tables.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.