Xtraction
Monthly
Ivanti Xtraction versions prior to 2026.4 are vulnerable to a path traversal flaw in the template export feature, allowing an authenticated attacker with low privileges to read arbitrary files accessible to the service account. Exploitation requires a valid session but no user interaction, and while confidentiality is compromised, no public exploit code or active exploitation has been identified; this is a genuine but second-tier priority rather than an emergency.
Missing authentication for a critical function in Ivanti Xtraction before version 2026.4 allows remote unauthenticated attackers to create or modify trusted site configurations. This vulnerability, tracked as CVE-2026-106043 with a CVSS score of 7.5, has a high integrity impact (I:H) but no confidentiality or availability impact (C:N/A:N) per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. No public exploit identified at time of analysis; however, successful exploitation requires network reachability to the Xtraction web interface, and instances restricted to internal networks face reduced risk.
Credential disclosure in Ivanti Xtraction (versions before 2026.4) allows an attacker holding a valid low-privileged authenticated account to manipulate a file name or path value the application uses, redirecting application-generated requests to an attacker-controlled endpoint and capturing EPMM connector credentials transmitted by the application. The flaw is network-reachable and requires only low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), and because the vulnerable component crosses a trust boundary the scope is changed (S:C) with High confidentiality impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided. Exposure is conditional: the credential-theft path only exists where Xtraction is configured with an EPMM connector that transmits credentials during request processing, so organizations not integrating Xtraction with EPMM are not exposed through this vector.
Path traversal in Ivanti Xtraction enables remote authenticated attackers with low-level privileges to read sensitive system files and inject arbitrary HTML into web-accessible directories, creating risks of credential theft, configuration exposure, and client-side attacks against other users. CVSS 9.6 severity driven by scope change (S:C) indicates the attacker can impact resources beyond the vulnerable component. No public exploit or CISA KEV listing identified, but vendor advisory confirms the vulnerability affects all versions prior to 2026.2.
Ivanti Xtraction Cloud Sync before 2026.4 can expose partial SQL database passwords to an authenticated low-privileged user with local access to the application log. The authoritative assessment rates this CWE-532 information disclosure as AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating local access, low privileges, and limited confidentiality impact because only partial passwords are logged rather than full credentials; no public exploit was identified at time of analysis. This is a moderate-severity, low-priority issue rather than an urgent threat, and it is fixed in version 2026.4.
Path traversal in Ivanti Xtraction (all versions before 2026.4) lets a remote authenticated attacker create or modify directories at arbitrary locations on the host file system by supplying crafted path input to a directory-handling feature. The vendor rates it 5.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N), reflecting a scope change onto the underlying host with integrity-only impact and no confirmed confidentiality or availability effect; exploitation requires a valid Xtraction account, and no public exploit code has been identified at time of analysis. Upgrading to 2026.4 removes the vulnerable condition.
Arbitrary file disclosure in Ivanti Xtraction before 2026.2.1 lets a remote, authenticated attacker traverse outside the application's web root and read sensitive files from the underlying host. The CVSS 3.1 score of 7.7 reflects a scope change (S:C), meaning the impact reaches beyond the web application into the host filesystem, though only confidentiality is affected. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; no EPSS score was provided.
Open redirect in Ivanti Xtraction before 2026.2.1 enables remote unauthenticated attackers to craft URLs that silently forward users to arbitrary external destinations. The vulnerability carries a Scope:Changed rating (S:C) in the CVSS vector, reflecting that the impact extends beyond the vulnerable application to the user's browser environment - a hallmark of effective phishing and credential harvesting campaigns. No public exploit code and no CISA KEV listing exist at time of analysis, and the AC:H metric in the vendor-provided vector suggests exploitation may not be trivially reliable in all configurations.
Ivanti Xtraction versions prior to 2026.4 are vulnerable to a path traversal flaw in the template export feature, allowing an authenticated attacker with low privileges to read arbitrary files accessible to the service account. Exploitation requires a valid session but no user interaction, and while confidentiality is compromised, no public exploit code or active exploitation has been identified; this is a genuine but second-tier priority rather than an emergency.
Missing authentication for a critical function in Ivanti Xtraction before version 2026.4 allows remote unauthenticated attackers to create or modify trusted site configurations. This vulnerability, tracked as CVE-2026-106043 with a CVSS score of 7.5, has a high integrity impact (I:H) but no confidentiality or availability impact (C:N/A:N) per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. No public exploit identified at time of analysis; however, successful exploitation requires network reachability to the Xtraction web interface, and instances restricted to internal networks face reduced risk.
Credential disclosure in Ivanti Xtraction (versions before 2026.4) allows an attacker holding a valid low-privileged authenticated account to manipulate a file name or path value the application uses, redirecting application-generated requests to an attacker-controlled endpoint and capturing EPMM connector credentials transmitted by the application. The flaw is network-reachable and requires only low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), and because the vulnerable component crosses a trust boundary the scope is changed (S:C) with High confidentiality impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided. Exposure is conditional: the credential-theft path only exists where Xtraction is configured with an EPMM connector that transmits credentials during request processing, so organizations not integrating Xtraction with EPMM are not exposed through this vector.
Path traversal in Ivanti Xtraction enables remote authenticated attackers with low-level privileges to read sensitive system files and inject arbitrary HTML into web-accessible directories, creating risks of credential theft, configuration exposure, and client-side attacks against other users. CVSS 9.6 severity driven by scope change (S:C) indicates the attacker can impact resources beyond the vulnerable component. No public exploit or CISA KEV listing identified, but vendor advisory confirms the vulnerability affects all versions prior to 2026.2.
Ivanti Xtraction Cloud Sync before 2026.4 can expose partial SQL database passwords to an authenticated low-privileged user with local access to the application log. The authoritative assessment rates this CWE-532 information disclosure as AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating local access, low privileges, and limited confidentiality impact because only partial passwords are logged rather than full credentials; no public exploit was identified at time of analysis. This is a moderate-severity, low-priority issue rather than an urgent threat, and it is fixed in version 2026.4.
Path traversal in Ivanti Xtraction (all versions before 2026.4) lets a remote authenticated attacker create or modify directories at arbitrary locations on the host file system by supplying crafted path input to a directory-handling feature. The vendor rates it 5.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N), reflecting a scope change onto the underlying host with integrity-only impact and no confirmed confidentiality or availability effect; exploitation requires a valid Xtraction account, and no public exploit code has been identified at time of analysis. Upgrading to 2026.4 removes the vulnerable condition.
Arbitrary file disclosure in Ivanti Xtraction before 2026.2.1 lets a remote, authenticated attacker traverse outside the application's web root and read sensitive files from the underlying host. The CVSS 3.1 score of 7.7 reflects a scope change (S:C), meaning the impact reaches beyond the web application into the host filesystem, though only confidentiality is affected. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; no EPSS score was provided.
Open redirect in Ivanti Xtraction before 2026.2.1 enables remote unauthenticated attackers to craft URLs that silently forward users to arbitrary external destinations. The vulnerability carries a Scope:Changed rating (S:C) in the CVSS vector, reflecting that the impact extends beyond the vulnerable application to the user's browser environment - a hallmark of effective phishing and credential harvesting campaigns. No public exploit code and no CISA KEV listing exist at time of analysis, and the AC:H metric in the vendor-provided vector suggests exploitation may not be trivially reliable in all configurations.