Ivanti Xtraction EUVD-2026-43682

No authentication is required - the CVSS vector PR:N confirms unauthenticated access. The attacker must be able to reach the Xtraction application over the network (AV:N). A victim user must follow the crafted redirect URL, as open redirect attacks are inherently social-engineering dependent (notably, the vendor CVSS vector specifies UI:N, which is inconsistent with typical open redirect exploitation mechanics - defenders should verify with Ivanti whether any server-side redirect path exists that does not require user interaction). Exploitation is limited to redirect/phishing impact; there is no code execution, data exfiltration, or direct system compromise possible through this vulnerability alone. Instances not exposed to untrusted users or the internet have substantially reduced risk.

The vendor-assigned CVSS base score of 4.0 reflects a genuinely moderate risk. The vector AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N warrants scrutiny: AC:H (high complexity) implies reliable exploitation is non-trivial, while UI:N (no user interaction required) is atypical for open redirects, which ordinarily require a victim to follow the crafted link - this merits verification with the vendor. No EPSS score was provided in the source data. The absence of a KEV listing and no public exploit code both indicate this is not currently being mass-exploited. Real-world risk is bounded by the nature of the flaw: open redirects are primarily useful for phishing, brand abuse, and as a component of multi-stage attacks rather than as a standalone critical compromise path. Security teams at organizations using Ivanti Xtraction in external-facing or hybrid environments should treat this as a medium-priority patch given the unauthenticated attack surface, but it does not warrant emergency response absent evidence of targeted use.

An attacker crafts a URL pointing to the Xtraction instance with a manipulated redirect parameter targeting a lookalike phishing page (e.g., a fake Ivanti or corporate SSO login). The attacker distributes this link via email or messaging, leveraging the trusted Ivanti domain to bypass user suspicion or email gateway reputation checks. The victim follows the link, is transparently forwarded to the attacker-controlled site, and may submit credentials believing they are authenticating to a legitimate service.