CVE-2026-106042: Critical severity Ivanti Xtraction vulnerability
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ivanti Xtractionto a version that resolves this vulnerability.Fixed in 2026.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to authenticate remotely to Ivanti Xtraction. The available information does not identify any required role or privilege level beyond authentication.
What is the practical impact of exploitation?
An authenticated attacker can cause the application to send application-generated requests to an endpoint they control, allowing them to obtain EPMM connector credentials transmitted in those requests. The reported impact includes compromise of confidentiality, integrity, and availability.
Which deployments are affected?
Ivanti Xtraction versions before 2026.4 are affected. The provided information does not state whether any particular configuration, including the default configuration, is required.
What should teams do if they cannot immediately upgrade?
The provided information does not list a workaround or mitigation. Prioritize restricting access to authenticated Xtraction users and review exposure of EPMM connector credentials until an upgrade to version 2026.4 or later can be completed.