Xtraction (Ivanti) - vulnerabilities (CVEs)
8 CVEs, 5 in the last 30 days, 23 known versions, newest CVE from 2026-10-13. Vendor: Ivanti.
CVEs of Xtraction
- CVE-2026-106047 - CVSS 7.7 (high), 2026-10-13: A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read…
- CVE-2026-106043 - CVSS 7.5 (high), 2026-10-13: A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create,…
- CVE-2026-106042 - CVSS 9.9 (critical), 2026-10-13: An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect…
- CVE-2026-106035 - CVSS 5.5 (medium), 2026-10-13: An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to…
- CVE-2026-106034 - CVSS 5 (medium), 2026-10-13: A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the…
- CVE-2026-14903 - CVSS 7.7 (high), 2026-07-14: Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.
- CVE-2026-14902 - CVSS 6.1 (medium), 2026-07-14: An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.
- CVE-2026-8043 - CVSS 9.6 (critical), 2026-05-12: External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary…
