Ivanti Xtraction Path Flaw Enables Credential Theft for Authenticated Users

Ivanti Xtraction contains a critical security flaw that permits authenticated attackers to hijack application requests and steal sensitive credentials. This vulnerability, identified as CVE-2026-106042, affects all versions of the software released before version 2026.4. The issue stems from how the application handles file paths, allowing malicious actors to manipulate where data is sent.

Root cause

The underlying issue is classified under CWE-73, which relates to external control of file names or paths. According to the National Vulnerability Database, this weakness allows an attacker to influence the destination of application-generated requests. Instead of sending data to the intended secure endpoint, the application can be tricked into transmitting information to a location controlled by the attacker. This misdirection occurs because the software allows external control over file name or path parameters.

Attack path

Exploitation requires the attacker to possess valid authentication credentials for the Ivanti Xtraction system. Once authenticated, the attacker can craft requests that redirect the application’s output to an endpoint they control. During this process, the application transmits EPMM connector credentials. These credentials are captured by the attacker at the malicious endpoint. The severity of this exposure is reflected in the CVSS score of 9.9, which the NVD rates as critical.

Affected versions

• Ivanti Xtraction versions prior to 2026.4 are vulnerable to this exploitation.
• The source material specifies the vulnerability exists in versions before 2026.4.
• The advisory focuses solely on Ivanti Xtraction.

Mitigation

• Ensure all Ivanti Xtraction instances are updated to version 2026.4 or newer.
• Audit authentication logs for unusual request redirection patterns.
• Restrict network access to the application to minimise exposure.
• Monitor for any unauthorised endpoints receiving application data.

Why it matters

Understanding this flaw helps teams grasp how path manipulation risks arise. Applications often trust internal logic to direct data flows. When external inputs can alter these paths, the integrity of data transmission breaks down. For non-specialists, this highlights the importance of validating where data goes, not just who sends it. Teams usually implement strict input validation to prevent such redirection. Checking configuration settings for path handling is a standard practice. This incident underscores that even authenticated users can pose risks if system boundaries are weak.

Background: National Vulnerability Database

The National Vulnerability Database provides standard identifiers for software flaws. You use these identifiers to automate patching and verify vendor claims. Small teams should cross-reference database entries with their IT asset inventory to prioritise fixes and avoid wasting time on irrelevant alerts.

Read the full guide: National Vulnerability Database: Small Business Action Plan

What to do and how to stay safe: Ivanti

• Verify your current Ivanti Xtraction version against the 2026.4 threshold.
• Review authentication logs for signs of request redirection anomalies.
• Implement network segmentation to limit access to the application.
• Once the vendor provides an update, apply it promptly to affected systems.

Step-by-step guide: Security Advisories: 6 Common Misreadings That Leave Systems Exposed

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-106042?

The National Vulnerability Database rates CVE-2026-106042 as critical with a CVSS score of 9.9.

Which versions of Ivanti Xtraction are affected?

All versions of Ivanti Xtraction prior to version 2026.4 are affected by this vulnerability.

Does an attacker need authentication to exploit this flaw?

Yes, the attacker must be authenticated to redirect requests and steal credentials.