CVE-2026-106042
Received Received - Intake

External Control of File Path in Ivanti Xtraction

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: ivanti

Description
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-106042
EUVD
EUVD-2026-98848

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ivanti xtraction to 2026.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an External Control of File Name or Path issue in Ivanti Xtraction software before version 2026.4. It allows a remote authenticated attacker to manipulate file paths used by the application, redirecting requests to attacker-controlled endpoints. This can lead to the theft of EPMM connector credentials that the application transmits during normal operations.

Impact Analysis

If you use Ivanti Xtraction before version 2026.4, an attacker could exploit this to gain access to sensitive credentials used by the application. This could allow them to impersonate your system, access protected data, or perform unauthorized actions through the compromised credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. If credentials are compromised, it may result in data breaches, triggering mandatory breach notifications and potential fines under these regulations.

Mitigation Strategies

Update Ivanti Xtraction to version 2026.4 or later to address the vulnerability. Ensure only trusted users have remote access and monitor network traffic for unusual requests to external endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106042. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart