CVE-2026-106043
HighCVSS 7.5Summary
A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify trusted site.
Risk Assessment
Attackers can add malicious sites to the trusted list, potentially leading to further attacks such as phishing or content injection.
Recommendation
Update Ivanti Xtraction to version 2026.4 or later. Also verify the trusted sites list and monitor for unauthorized changes.
Other vulnerabilities in Ivanti Xtraction
See all- CVE-2026-106047High
A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.
- CVE-2026-106034Medium
A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system.
- CVE-2026-106042Critical
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.
- CVE-2026-8043Critical
In Ivanti Xtraction before version 2026.2, external control of a file name allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.
- CVE-2026-14903High
A path traversal vulnerability in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.
- CVE-2026-14902Medium
An open redirect vulnerability in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.
Original NVD description (English source)
A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS