Ivanti Xtraction Critical Flaw Allows Credential Theft Before 2026.4
A critical remote vulnerability in Ivanti Xtraction enables attackers to steal EPMM connector credentials via file path manipulation.
Key points
- CVE-2026-106042 is rated critical with a CVSS score of 9.9.
- The flaw affects Ivanti Xtraction versions prior to 2026.4.
- Attackers must be authenticated to exploit the external file path control issue.
Ivanti Xtraction contains a critical security vulnerability that allows remote attackers to steal sensitive credentials. The National Vulnerability Database lists this flaw as CVE-2026-106042 with a maximum severity score. This issue impacts all versions of the software released before version 2026.4.
At a glance
- CVE
- CVE-2026-106042
- Product
- Ivanti Xtraction
- CVSS
- 9.9 Critical
- Weakness
- CWE-73
- Exploited
- No known exploitation
Technical Details of the Vulnerability
The vulnerability stems from an external control of file name or path weakness, categorized under CWE-73. According to the NVD record, an authenticated attacker can manipulate application-generated requests. This manipulation redirects those requests to an endpoint controlled by the attacker. The exploit specifically targets the transmission of EPMM connector credentials.
The CVSS score of 9.9 indicates a critical risk level for organizations using this software. The ability to redirect requests means that sensitive data sent by the application can be intercepted. The attacker gains access to the credentials that the application uses to communicate with the EPMM connector. This access could facilitate further unauthorized actions within the connected systems.
Scope and Affected Systems
The flaw is present in Ivanti Xtraction versions earlier than 2026.4. Organizations running these older versions are exposed to the risk of credential theft. The vulnerability requires the attacker to have an authenticated session with the application. This requirement limits the immediate attack surface to those who can obtain valid login credentials.
Despite the authentication requirement, the impact remains severe due to the sensitivity of the stolen data. EPMM connector credentials likely provide access to critical management or monitoring functions. The exposure of these credentials could compromise the integrity of the broader infrastructure managed by Xtraction. Users of the software must verify their current version against the affected range.
What should you do?
Organizations should immediately audit their Ivanti Xtraction installations to determine if they are running a vulnerable version. If the software version is below 2026.4, the risk of credential theft is present. Security teams should monitor for any unusual redirection of application requests or unauthorized access attempts. Until a fix is confirmed and deployed, limiting network exposure may help mitigate the risk.
What to do and how to stay safe: Ivanti
- Verify the installed version of Ivanti Xtraction to ensure it is not prior to 2026.4.
- Monitor application logs for unexpected request redirections or unauthorized endpoint connections.
- Restrict access to the application to reduce the pool of potential authenticated attackers.
- Prepare to apply updates once the vendor releases a patch for CVE-2026-106042.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-106042?
The National Vulnerability Database rates CVE-2026-106042 as critical with a CVSS score of 9.9.
Which versions of Ivanti Xtraction are affected?
All versions of Ivanti Xtraction before version 2026.4 are affected by this vulnerability.
Does the attacker need to be authenticated to exploit this flaw?
Yes, the vulnerability allows a remote authenticated attacker to redirect requests and obtain credentials.
