CVE-2026-14903
HighCVSS 7.7Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
A path traversal vulnerability in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.
Risk Assessment
An attacker could access sensitive configuration files, credentials, or other confidential data stored on the server, leading to confidentiality breach and potential attack escalation.
Recommendation
Immediately update Ivanti Xtraction to version 2026.2.1 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Ivanti Xtraction
See all- CVE-2026-8043Critical
In Ivanti Xtraction before version 2026.2, external control of a file name allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.
- CVE-2026-14902Medium
An open redirect vulnerability in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.
Original NVD description (English source)
Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.