Ivanti Xtraction vulnerabilities

8 CVEs affecting Ivanti Xtraction, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-106047, published 2026-10-13.

More from Ivanti.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-14903, published 2026-07-14. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. Path traversal in Ivanti  Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.
• CVE-2026-8043, published 2026-05-12. Critical severity, CVSS 9.6. EPSS: 1.2% chance of exploitation in the next 30 days. External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to…
• CVE-2026-106042, published 2026-10-13. Critical severity, CVSS 9.9. EPSS: 0.8% chance of exploitation in the next 30 days. An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an…
• CVE-2026-106047, published 2026-10-13. High severity, CVSS 7.7. EPSS: 0.7% chance of exploitation in the next 30 days. A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.
• CVE-2026-14902, published 2026-07-14. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.
• CVE-2026-106043, published 2026-10-13. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.
• CVE-2026-106034, published 2026-10-13. Medium severity, CVSS 5.0. EPSS: 0.5% chance of exploitation in the next 30 days. A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system.
• CVE-2026-106035, published 2026-10-13. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through…