Ivanti Xtraction CWE-73 Vulnerability Lets Authenticated Users Hijack Requests to Steal Credentials

Ivanti Xtraction contains a critical vulnerability that allows remote authenticated attackers to steal sensitive connector credentials. The flaw, identified as CVE-2026-106042, stems from an External Control of File Name or Path weakness. According to the National Vulnerability Database, this issue affects Ivanti Xtraction before version 2026.4. Security teams should assess their environments immediately to determine if they are running vulnerable software.

Root cause

The underlying weakness is categorized as CWE-73, which refers to external control of file names or paths. The source material describes this as an External Control of File Name or Path vulnerability. This classification indicates that the application allows external influence over file path resolution. This mechanism enables the redirection of application-generated requests. The specific technical implementation details regarding input validation are not provided in the source record.

Attack path

An attacker must first obtain valid authentication credentials for an Ivanti Xtraction instance. The source material specifies that a remote authenticated attacker is required. Once authenticated, the attacker can exploit the vulnerability to redirect application-generated requests. These requests are sent to an attacker-controlled endpoint. The application transmits EPMM connector credentials during this process. This allows the attacker to obtain the credentials.

Affected versions

• Ivanti Xtraction before version 2026.4 is vulnerable to CVE-2026-106042.
• The source material does not confirm the status of version 2026.4 or later.
• Organizations must verify their current installation version against the affected range.

Mitigation

• Verify if your environment runs Ivanti Xtraction before version 2026.4.
• Monitor network traffic for unusual outbound connections from the application.
• Review server logs for evidence of request redirection attempts.
• Restrict access to Ivanti Xtraction to limit potential attackers.

Signals worth monitoring

Security operations teams should watch for anomalous outbound network connections originating from Ivanti Xtraction servers. Look for traffic directed to unfamiliar or newly registered external endpoints, especially during normal business hours. Check application logs for errors related to file path resolution or unexpected redirection attempts. If credentials are being transmitted to unknown hosts, investigate immediately. Teams usually isolate affected systems to prevent further data exfiltration while conducting a forensic review of network flows and application logs.

What to do and how to stay safe: Ivanti

• Inventory all instances of Ivanti Xtraction to identify those running versions before 2026.4.
• Plan an upgrade to version 2026.4 or later once the vendor provides an update.
• Review authentication logs for any recent access by compromised or suspicious accounts.
• Monitor network egress for connections to unexpected destinations that could indicate active exploitation.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of CVE-2026-106042?

The National Vulnerability Database rates CVE-2026-106042 as critical with a CVSS score of 9.9.

Does this vulnerability require authentication to exploit?

Yes, the source material states that a remote authenticated attacker is required to exploit this flaw.

What specific credentials can be stolen through this vulnerability?

Attackers can obtain EPMM connector credentials that are transmitted by the application during the redirection.