What is the CVSS score of CVE-2026-8043?

CVE-2026-8043 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Ivanti Xtraction are affected by CVE-2026-8043?

Ivanti Xtraction contains a critical path traversal vulnerability (CVSS 9.6) that allows authenticated users with low privileges to read sensitive system files and inject malicious HTML into web…

How to fix or mitigate CVE-2026-8043?

Within 24 hours: Identify and inventory all Ivanti Xtraction deployments and their current versions; disable or restrict network access to affected instances. Within 7 days: Contact Ivanti for patch availability timeline and interim guidance; implement network segmentation to limit authentication access to Xtraction. Within 30 days: Apply vendor-released patch to version 2026.2 or later upon availability; audit access logs for suspicious authenticated activity and file access patterns.

Ivanti Xtraction CVE-2026-8043

EUVD-2026-29487 CRITICAL

External Control of File Name or Path (CWE-73)

2026-05-12 ivanti

GHSA-w9px-xqr4-32j9

Information Disclosure Ivanti

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 15:30 vuln.today

CVE Published

May 12, 2026 - 14:11 nvd

CRITICAL 9.6

DescriptionCVE.org

External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.

AnalysisAI

Path traversal in Ivanti Xtraction enables remote authenticated attackers with low-level privileges to read sensitive system files and inject arbitrary HTML into web-accessible directories, creating risks of credential theft, configuration exposure, and client-side attacks against other users. CVSS 9.6 severity driven by scope change (S:C) indicates the attacker can impact resources beyond the vulnerable component. No public exploit or CISA KEV listing identified, but vendor advisory confirms the vulnerability affects all versions prior to 2026.2.

Technical ContextAI

This vulnerability stems from CWE-73 (External Control of File Name or Path), commonly known as path traversal or directory traversal. Ivanti Xtraction, a data extraction and transformation platform, fails to properly sanitize user-supplied file path input from authenticated users. The CVSS vector AV:N indicates the vulnerable functionality is exposed over the network, likely through a web interface or API endpoint. The attacker can manipulate file path parameters to escape intended directory boundaries using sequences like '../' to read files outside the application's designated data directory, and also write HTML content to the web root. The scope change indicator (S:C) suggests successful exploitation allows the attacker to affect confidentiality and integrity of resources managed under different security authorities than the vulnerable component itself.

RemediationAI

Upgrade Ivanti Xtraction to version 2026.2 or later as specified in the vendor security advisory at https://hub.ivanti.com/s/article/Security-Advisory---Ivanti-Xtraction-CVE-2026-8043?language=en_US. If immediate patching is not feasible, implement compensating controls: restrict network access to Xtraction web interfaces using firewall rules or VPN-only access to reduce attack surface (trade-off: impacts remote workflow); enforce principle of least privilege by auditing and removing unnecessary user accounts, especially those with file upload/download permissions (trade-off: may require access request processes); enable comprehensive file access logging and monitor for suspicious path traversal patterns in request parameters such as '../' sequences or absolute paths (trade-off: increases log volume and requires SIEM integration). Deploy web application firewall (WAF) rules to block common path traversal payloads in HTTP parameters, though sophisticated attackers may bypass signature-based detection. Note that compensating controls only reduce risk and cannot fully mitigate the vulnerability-patching to 2026.2 is the definitive solution.