Ivanti Xtraction vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Ivanti Xtraction: 8 record(s), with affected versions and fixes.cpe:2.3:a:ivanti:xtraction
CVE-2026-106047
High · 7.7
CWE-22 Oct 13, 2026
A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before...
A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.
CVE-2026-106043
High · 7.5
CWE-306 Oct 13, 2026
A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version...
A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.
CVE-2026-106042
Critical · 9.9
CWE-73 Oct 13, 2026
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4...
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.
CVE-2026-106035
Medium · 5.5
CWE-532 Oct 13, 2026
An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before...
An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log.
CVE-2026-106034
Medium · 5.0
CWE-22 Oct 13, 2026
A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote...
A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system.
CVE-2026-14903
Medium · 6.5
CWE-23 Jul 14, 2026
Relative Path Traversal in Ivanti Xtraction
Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.
CVE-2026-14902
Medium · 6.1
CWE-601 Jul 14, 2026
Open Redirect in Ivanti Xtraction
An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.
CVE-2026-8043
Critical · 9.6
CWE-73 May 12, 2026
External control of a file name in Ivanti Xtraction before version 2026.2 allows a…
External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.