CVE-2021-42132: Ivanti Avalanche Inforail Service command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability and high EPSS, but exploitation requires existing access to the Inforail Service and no active exploitation is documented.

What it is

Ivanti Avalanche before 6.3.3 contains a command injection flaw in the Inforail Service that lets an attacker with access to that service run arbitrary commands. Because the injected commands execute with the service's privileges, a foothold on the service can be turned into full control of the host. The record gives no further detail on the vulnerable code path or the exact interface exposed.

Impact

An attacker who can reach the Inforail Service gains arbitrary command execution on the Avalanche server, with high impact to confidentiality, integrity and availability. This can lead to full compromise of the host and any data or downstream devices it manages.

Attack surface

The flaw is network-reachable (AV:N) and requires low privileges (PR:L) with no user interaction (UI:N), meaning the attacker must already have some access to the Inforail Service rather than being fully unauthenticated. The description does not specify which port, protocol or endpoint is involved.

Exploitation

No exploitation is confirmed: the CVE is not listed in CISA KEV and no ransomware use is documented, though EPSS is high at roughly 0.70 (99th percentile), suggesting elevated likelihood of attempted exploitation. The only references are the vendor advisory.

What to do

• Upgrade Ivanti Avalanche to 6.3.3 or later, per the vendor security alert.
• Restrict network access to the Inforail Service to trusted hosts and management networks only.
• Enforce least privilege on accounts that can reach the service and remove unused or default credentials.
• Monitor and log command execution and process creation on Avalanche hosts for unexpected child processes.
• If patching cannot be done immediately, isolate affected Avalanche servers from untrusted networks.

Detection

• Alert on unexpected child processes spawned by the Avalanche/Inforail service, especially shells or command interpreters.
• Review service and web logs for anomalous requests or inputs to the Inforail Service around the time of suspicious process activity.
• Baseline normal Inforail Service network peers and flag connections from unfamiliar hosts.
• Correlate process creation events on Avalanche hosts with inbound connections to the service to spot injection attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.