CVE-2026-106042
CriticalCVSS 9.9Summary
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.
Risk Assessment
An attacker can capture EPMM connector credentials, enabling unauthorized access to mobility management systems and further escalation. This breaches confidentiality and may lead to compromise of managed devices.
Recommendation
Upgrade Ivanti Xtraction to version 2026.4 or later. After upgrading, consider rotating EPMM connector credentials and review logs for unusual redirects.
Other vulnerabilities in Ivanti Xtraction
See all- CVE-2026-106047High
A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.
- CVE-2026-106043High
A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify trusted site.
- CVE-2026-106034Medium
A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system.
- CVE-2026-8043Critical
In Ivanti Xtraction before version 2026.2, external control of a file name allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.
- CVE-2026-14903High
A path traversal vulnerability in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.
- CVE-2026-14902Medium
An open redirect vulnerability in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.
Original NVD description (English source)
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS