Ivanti Xtraction EUVD-2026-98848

Exploitation requires (1) valid authenticated access to Ivanti Xtraction at low privilege (CVSS PR:L), and (2) the application being configured with an EPMM connector that transmits credentials during request processing - if no EPMM connector is deployed, there are no connector credentials to harvest. The attacker must be able to supply or influence a file name/path value that the application uses to direct an outbound request (CWE-73). Limiting factors: authentication is mandatory (not exploitable by fully unauthenticated attackers), and value is contingent on an active EPMM connector configuration; environments not integrating Xtraction with EPMM are not exposed to credential theft via this path.

Multiple signals must be weighed carefully here. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9 Critical) indicates a low-complexity, remotely reachable flaw requiring only low-privilege authentication, with a scope change - consistent with the description, since stolen EPMM connector credentials grant access to a separate system (Ivanti EPMM). However, the I:H and A:H ratings appear inflated: the described impact is purely credential disclosure (External Control of File Name or Path, CWE-73, redirecting application requests to an attacker endpoint), which is fundamentally a confidentiality compromise, not integrity or availability destruction on the Xtraction system itself. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The practical priority is driven by the scope change and the sensitivity of harvested EPMM credentials (which govern mobile device management) rather than by any confirmed exploitation signal. This is a genuine high-value target for authenticated insiders or attackers who have already gained a foothold, but the PR:L authentication requirement meaningfully limits mass, unauthenticated exploitation. Note: the 9.9 score reflects vendor self-assessment including I:H/A:H that the description does not substantiate - treat the raw score with caution and prioritize based on credential exposure.

An attacker with valid low-privileged Xtraction credentials manipulates a file name or path parameter to redirect application-generated requests to an attacker-controlled endpoint. When Xtraction transmits EPMM connector credentials as part of its normal operation, those credentials are captured by the attacker's server, enabling subsequent unauthorized access to the connected Ivanti EPMM environment. No public exploit code has been identified at time of analysis.