What is the CVSS score of CVE-2026-14903?

CVE-2026-14903 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 1.0%.

Which versions of Xtraction are affected by CVE-2026-14903?

Ivanti Xtraction versions prior to 2026.2.1 allow authenticated users to read arbitrary files from the hosting server, creating direct risk of credential, configuration, and sensitive data exposure.

How to fix or mitigate CVE-2026-14903?

Within 24 hours: Inventory all Ivanti Xtraction deployments and document versions in use; establish real-time alerting on Xtraction authentication logs for anomalous access patterns. Within 7 days: Restrict the Xtraction application account's operating system-level file permissions to read-only access within the application directory only; audit recent file access and authentication logs for evidence of unauthorized file reads from sensitive system directories. Within 30 days: Subscribe to Ivanti security notifications and prepare an upgrade plan targeting Ivanti Xtraction version 2026.2.1 or later; deploy file integrity monitoring rules on sensitive system directories (/etc, credential stores, application config directories) configured to alert on unauthorized access from Xtraction application processes.

Xtraction CVE-2026-14903

EUVD-2026-43684 MEDIUM

Relative Path Traversal (CWE-23)

2026-07-14 ivanti

GHSA-9jjf-4p7p-4qv4

Path Traversal Ivanti Xtraction

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (ivanti) PRIMARY

HIGH

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (ivanti).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Aug 06, 2026 - 17:37 NVD

HIGH MEDIUM

CVSS changed

Aug 06, 2026 - 17:37 NVD

7.7 (HIGH) 6.5 (MEDIUM)

Analysis Generated

Jul 14, 2026 - 14:47 vuln.today

CVE Published

Jul 14, 2026 - 14:26 cve.org

HIGH 7.7

DescriptionNVD

Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.

AnalysisAI

Arbitrary file disclosure in Ivanti Xtraction before 2026.2.1 lets a remote, authenticated attacker traverse outside the application's web root and read sensitive files from the underlying host. The CVSS 3.1 score of 7.7 reflects a scope change (S:C), meaning the impact reaches beyond the web application into the host filesystem, though only confidentiality is affected. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; no EPSS score was provided.