Ivanti Xtraction EUVD-2026-98909

Requires an authenticated session on Ivanti Xtraction with at least low-privilege access (CVSS PR:L) and reachability of the web-based template export functionality, which is the specific feature abused. Exploitation is limited by the need for valid credentials - this is not an unauthenticated flaw - but is otherwise unconstrained: no user interaction is required (UI:N), complexity is low (AC:L), and it is reachable over the network. Impact is confined to reading arbitrary files accessible to the Xtraction service account (confidentiality only); it does not by itself modify data or disrupt availability. Affected versions are those prior to 2026.4 per the vendor.

This is a genuine but second-tier priority rather than an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7 High) indicates a network-reachable, low-complexity attack that requires low-level authentication (PR:L) and no user interaction, with a confidentiality-only impact amplified by a changed scope. There is no corroborating exploitation-probability signal: no EPSS score, no CISA KEV listing, and no public POC were supplied, so the real-world exploitation likelihood cannot be quantified from the input - treat the absence of these as missing data, not as evidence of low risk. The signals are internally consistent (a path-traversal file read naturally maps to C:H/I:N/A:N and to AC:L), and the PR:L requirement meaningfully limits the attacker population to those who already hold valid, if low-privileged, Xtraction credentials. The single vendor-only reference (Ivanti advisory hub) is the sole source; affected-version data ('before 2026.4') is vendor-stated but not independently corroborated by NVD CPE version ranges in the input (the CPE is a wildcard). Net: a credible authenticated information-disclosure flaw worth patching on a normal-to-expedited cycle, but not showing the active-exploitation or wormable characteristics that would justify emergency out-of-band action.

An attacker who holds or phishes a low-privileged Xtraction account logs in and abuses the template export feature, supplying a crafted path (e.g. directory-traversal sequences) where a template filename is expected. The server resolves the path outside the intended template directory and returns arbitrary files - such as configuration files, credentials, or connection strings - enabling further compromise. No public exploit code was identified at time of analysis, and no user interaction is required beyond the attacker's own authenticated session.