CVE-2026-106035: Medium severity Ivanti Xtraction Cloud Sync vulnerability
An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ivanti Xtraction Cloud Syncto a version that resolves this vulnerability.Fixed in 2026.4
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker must be authenticated to Ivanti Xtraction Cloud Sync. The vulnerability is therefore most relevant where lower-privileged or untrusted authenticated users can access the application.
What information could be exposed?
Application logs can disclose partial SQL database passwords. The available information does not indicate that complete passwords or other database credentials are exposed.
Which versions need remediation?
Ivanti Xtraction Cloud Sync versions before 2026.4 are affected. Upgrade to version 2026.4 or later.