Zero Day MonitorZDM

← Back to list

9.9

CVE-2026-106042PATCHED

ivanti · xtraction

CVE-2026-106042: An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authent

Description

An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.

Affected Products

Vendor	Product	Versions
ivanti	xtraction	—

References

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Xtraction-Multiple-CVEs

Related News (2 articles)

Tier D

The Hacker News4h ago

Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

→ No new info (linked only)

Tier C

VulDB5h ago

CVE-2026-106042 | Ivanti Xtraction up to 2026.3 path traversal

→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.19.9 CRITICAL

VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA KEV❌ No

Actively exploited❌ No

Patch available

2026.4

CWECWE-73

PublishedOct 13, 2026

Trending Score41

Source articles2

Independent2

Info Completeness0/14

Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

HIGHCVE-2026-104935

CVE-2026-104935: Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arb

CRITICALCVE-2026-109412

CVE-2026-109412: An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitiv

HIGHCVE-2026-106043

CVE-2026-106043: A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote u

HIGHCVE-2026-106047

CVE-2026-106047: A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a r

MEDIUMCVE-2026-106035

CVE-2026-106035: An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a re

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Oct 13, 2026

Patch Available

Oct 13, 2026

Discovered by ZDM

Oct 13, 2026