What is the CVSS score of CVE-2026-14903?

CVE-2026-14903 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 1.0%.

Which versions of Xtraction are affected by CVE-2026-14903?

Ivanti Xtraction versions prior to 2026.2.1 allow authenticated users to read arbitrary files from the hosting server, creating direct risk of credential, configuration, and sensitive data exposure.

How to fix or mitigate CVE-2026-14903?

Within 24 hours: Inventory all Ivanti Xtraction deployments and document versions in use; establish real-time alerting on Xtraction authentication logs for anomalous access patterns. Within 7 days: Restrict the Xtraction application account's operating system-level file permissions to read-only access within the application directory only; audit recent file access and authentication logs for evidence of unauthorized file reads from sensitive system directories. Within 30 days: Subscribe to Ivanti security notifications and prepare an upgrade plan targeting Ivanti Xtraction version 2026.2.1 or later; deploy file integrity monitoring rules on sensitive system directories (/etc, credential stores, application config directories) configured to alert on unauthorized access from Xtraction application processes.

Xtraction CVE-2026-14903

EUVD-2026-43684 HIGH

Relative Path Traversal (CWE-23)

2026-07-14 ivanti

GHSA-9jjf-4p7p-4qv4

Path Traversal Ivanti Xtraction

7.7

CVSS 3.1 · Vendor: ivanti

Severity by source

Vendor (ivanti) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from Vendor (ivanti) · only source for this CVE.

CVSS VectorVendor: ivanti

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 14:47 vuln.today

CVE Published

Jul 14, 2026 - 14:26 cve.org

HIGH 7.7

DescriptionCVE.org

Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.

AnalysisAI

Arbitrary file disclosure in Ivanti Xtraction before 2026.2.1 lets a remote, authenticated attacker traverse outside the application's web root and read sensitive files from the underlying host. The CVSS 3.1 score of 7.7 reflects a scope change (S:C), meaning the impact reaches beyond the web application into the host filesystem, though only confidentiality is affected. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Inventory all Ivanti Xtraction deployments and document versions in use; establish real-time alerting on Xtraction authentication logs for anomalous access patterns. …

Threat intelligence, references, and detailed analysis are available after sign-in.