CVE-2026-14902
MediumCVSS 4.0Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
An open redirect vulnerability in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.
Risk Assessment
The risk involves potential phishing or social engineering attacks, where users could be redirected to malicious sites, leading to credential theft or malware infection.
Recommendation
It is recommended to immediately upgrade Ivanti Xtraction to version 2026.2.1 or later, which fixes this vulnerability.
Other vulnerabilities in Ivanti Xtraction
See all- CVE-2026-8043Critical
In Ivanti Xtraction before version 2026.2, external control of a file name allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.
- CVE-2026-14903High
A path traversal vulnerability in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.
Original NVD description (English source)
An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.