Xtraction Cloud Sync EUVD-2026-98847

Requires an authenticated low-privileged account on Ivanti Xtraction Cloud Sync (PR:L) and the ability to read the application log, where partial SQL database passwords are written during operation. The CVSS AV:L metric indicates local access to the log file/host is needed, which significantly limits exploitation versus a purely remote flaw. Disclosure is limited to PARTIAL passwords, not full credentials, further constraining impact. Fixed in version 2026.4; affects all prior versions. No user interaction is required (UI:N).

This is a moderate-severity, low-priority information disclosure issue (CWE-532) rather than an urgent threat. The CVSS 3.1 base score of 5.5 is driven by a local attack vector (AV:L), low complexity (AC:L), and low-privilege authentication (PR:L), with impact limited to confidentiality (C:H/I:N/A:N). There is a notable conflict between signals: the CVSS vector specifies AV:L (local access), while the CVE description states a 'remote authenticated attacker' - this discrepancy should be verified with Ivanti, as it materially changes exploitability. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided, so there is no public exploit identified at time of analysis. The confidentiality impact is further tempered by the fact that only PARTIAL SQL database passwords are exposed, which is inconsistent with a C:H rating and suggests the real-world confidentiality harm is lower than the score implies. Overall this is a high-CVSS-relative-to-real-risk log hygiene issue requiring prior authenticated access, not a widespread exploitation priority.

An attacker who already holds a low-privileged authenticated account on Ivanti Xtraction Cloud Sync (or access to its application log files) reads the application log and recovers partial SQL database credentials written there during sync operations. The partial password could aid a follow-on brute-force or guessing attack against the backend database. No public exploit code is known, and the CVSS local vector suggests the attacker needs log/host access rather than purely remote reach.