EUVD-2026-43684
GHSA-9jjf-4p7p-4qv4
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Relative path traversal prevention
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Arbitrary file disclosure in Ivanti Xtraction before 2026.2.1 lets a remote, authenticated attacker traverse outside the application's web root and read sensitive files from the underlying host. The CVSS 3.1 score of 7.7 reflects a scope change (S:C), meaning the impact reaches beyond the web application into the host filesystem, though only confidentiality is affected. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; no EPSS score was provided.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Xtraction gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (ivanti).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.
Executive ViewAI
Ivanti Xtraction versions prior to 2026.2.1 allow authenticated users to read arbitrary files from the hosting server, creating direct risk of credential, configuration, and sensitive data exposure. An attacker with legitimate application credentials-or who has compromised an account-could extract sensitive files without standard application controls detecting the breach. No vendor patch is currently available, leaving organizations dependent on interim compensating controls.
Within 24 hours: Inventory all Ivanti Xtraction deployments and document versions in use; establish real-time alerting on Xtraction authentication logs for anomalous access patterns. Within 7 days: Restrict the Xtraction application account's operating system-level file permissions to read-only access within the application directory only; audit recent file access and authentication logs for evidence of unauthorized file reads from sensitive system directories. Within 30 days: Subscribe to Ivanti security notifications and prepare an upgrade plan targeting Ivanti Xtraction version 2026.2.1 or later; deploy file integrity monitoring rules on sensitive system directories (/etc, credential stores, application config directories) configured to alert on unauthorized access from Xtraction application processes.
Restrict Xtraction application account to directory-level read access via OS file permissions and SELinux/AppArmor policies; implement file integrity monitoring with alerting on sensitive system files; enable continuous monitoring of Xtraction process and account-based file access logs; consider temporary disablement of non-critical Xtraction instances pending patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Credential disclosure in Ivanti Xtraction (versions before 2026.4) allows an attacker holding a valid low-privileged aut
Path traversal in Ivanti Xtraction enables remote authenticated attackers with low-level privileges to read sensitive sy
Ivanti Xtraction versions prior to 2026.4 are vulnerable to a path traversal flaw in the template export feature, allowi
Missing authentication for a critical function in Ivanti Xtraction before version 2026.4 allows remote unauthenticated a
Open redirect in Ivanti Xtraction before 2026.2.1 enables remote unauthenticated attackers to craft URLs that silently f
Ivanti Xtraction Cloud Sync before 2026.4 can expose partial SQL database passwords to an authenticated low-privileged u
Path traversal in Ivanti Xtraction (all versions before 2026.4) lets a remote authenticated attacker create or modify di
Exploit-DB