Ivanti Xtraction: Path control flaw exposes EPMM connector credentials
Summary
Ivanti Xtraction before version 2026.4 contains an External Control of File Name or Path flaw (CWE-73) that lets a remote authenticated attacker redirect application-generated requests to an attacker-controlled endpoint. The application then transmits EPMM connector credentials to that endpoint, which can enable further access to the connected EPMM service. The CVE record rates the issue 9.9 (CRITICAL), but NVD analysis was still pending and the vendor advisory could not be verified during research.
Affected
- Ivanti Xtraction before version 2026.4 (per the CNA record)
- The exact lower boundary is unclear: sources mention 2026.2.1 and prior, and 2026.3 in some listings, which conflicts with the CNA record.
Fixed in
- Update Ivanti Xtraction to version 2026.4 or later.
Workaround
Unknown. No workaround is documented in the sources reviewed; patching is the stated remedy.
Exploitation
- The vendor reportedly states it is not aware of exploitation (secondary source, not verified against the advisory).
- No public exploit or proof of concept was found.
- CISA KEV status is conflicting across sources; verify against the KEV catalogue.
- Do not confuse this with the actively exploited Ivanti Connect Secure issue CVE-2026-104935.
Our recommendation
- Check whether Xtraction is in use and whether it connects to an EPMM-type service.
- Verify whether Xtraction is reachable from untrusted networks.
- Patch Xtraction to version 2026.4 or later.
- Rotate all EPMM connector credentials used by the application, even after patching, because they may already have been sent to an uncontrolled endpoint.
- Review logs for unexpected outbound connections from Xtraction.
- Prioritise Ivanti Connect Secure appliances, which are being actively exploited.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Ivanti Security Advisory (not retrieved) hub.ivanti.com
- CVE-2026-106042 record mirror (threatint) cve.threatint.com
- Strix CVE-2026-106042 overview www.strix.ai
- VulDB entry 417791 vuldb.com
- Ivanti Xtraction critical vulnerabilities (SecurityOnline) securityonline.info
- Ivanti Security Advisory AV26-1035 (malware.news) malware.news
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:26.
Original description (NVD)
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.