Ivanti Xtraction CVE-2026-8043

Remote authenticated access to Ivanti Xtraction with low-privilege credentials (PR:L) is required-exploitation is not possible by unauthenticated attackers. The vulnerable functionality appears to be exposed through network-accessible interfaces (AV:N), likely file upload, download, or report generation features that accept user-controlled file path parameters. No special configuration is required beyond default Xtraction installations with remote access enabled. Exploitation is limited by the need for valid credentials but not by user interaction (UI:N) or complex attack prerequisites (AC:L). Organizations that restrict Xtraction access to highly trusted internal users only, or deploy it on isolated networks without internet exposure, face reduced practical risk, though authenticated insider threats remain.

Real-world risk is HIGH despite requiring authentication (PR:L). The 9.6 CVSS score accurately reflects severe impact: attackers can read configuration files containing credentials, database connection strings, or API keys (C:H), and inject malicious HTML/JavaScript into web directories to phish other users or steal session tokens (I:H). The scope change (S:C) means attackers breach compartmentalization boundaries, potentially pivoting from limited application access to broader system compromise. Attack complexity is low (AC:L) with no user interaction required (UI:N), making exploitation straightforward once authenticated access is obtained. No EPSS score provided but absence from CISA KEV and no public POC suggests exploitation is not yet widespread. However, path traversal vulnerabilities are well-understood and easily weaponized once discovered. Organizations using Xtraction for sensitive data operations face immediate risk if remote access is enabled for low-privileged accounts. The authentication requirement provides some defense-in-depth but should not reduce urgency given the critical nature of likely exposed data.

An attacker with low-privilege authenticated access to Ivanti Xtraction crafts HTTP requests containing manipulated file path parameters, such as '../../../../etc/passwd' or '../../../app/config/database.yml', to read sensitive system files and application configuration containing database credentials. The attacker then writes a malicious HTML file containing credential harvesting JavaScript to the web-accessible directory, which executes when legitimate administrators access the application, stealing their session tokens or credentials. Publicly available exploit code exists for path traversal vulnerabilities generically, though no CVE-2026-8043-specific POC is identified.