Ivanti Xtraction
8 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-106047 | fixed in 2026.4 | A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated | HIGH 7.7 | 0.7 % | ||
| CVE-2026-106043 | fixed in 2026.4 | A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attac | HIGH 7.5 | 0.7 % | ||
| CVE-2026-106042 | fixed in 2026.4 | An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to r | CRITICAL 9.9 | 0.8 % | ||
| CVE-2026-106035 | fixed in 2026.4 | An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated a | MEDIUM 5.5 | 0.3 % | ||
| CVE-2026-106034 | fixed in 2026.4 | A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary | MEDIUM 5.0 | 0.5 % | ||
| CVE-2026-14903 | fixed in 2026.2.1 | Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web r | HIGH 7.7 | 1.2 % | ||
| CVE-2026-14902 | fixed in 2026.2.1 | An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary externa | MEDIUM 6.1 | 0.7 % | ||
| CVE-2026-8043 | fixed in 2026.2 | External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and | CRITICAL 9.6 | 0.9 % |