CVE-2026-106035PATCHED

ivanti · xtraction

CVE-2026-106035: An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a re

Description

An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log.

Affected Products

Vendor	Product	Versions
ivanti	xtraction	—

References

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Xtraction-Multiple-CVEs

Related News (1 articles)

Tier C

VulDB6h ago

CVE-2026-106035 | Ivanti Xtraction up to 2026.3 Application Log log file

→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.15.5 MEDIUM

VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA KEV❌ No

Actively exploited❌ No

Patch available

2026.4

CWECWE-532

PublishedOct 13, 2026

Trending Score23

Source articles1

Independent1

Info Completeness0/14

Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

HIGHCVE-2026-104935

CVE-2026-104935: Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arb

Trending: 85

CRITICALCVE-2026-109412

CVE-2026-109412: An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitiv

Trending: 45

CRITICALCVE-2026-106042

CVE-2026-106042: An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authent

Trending: 41

HIGHCVE-2026-106043

CVE-2026-106043: A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote u

Trending: 36

HIGHCVE-2026-106047

CVE-2026-106047: A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a r

Trending: 27

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Oct 13, 2026

Discovered by ZDM

Oct 13, 2026

Patch Available

Oct 13, 2026