External risk intelligence

Ivanti Xtraction External Control of File Name or Path Vulnerability Allows Credential Theft

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-106042

Ivanti Xtraction is a reporting and dashboarding application typically deployed as a web-based service accessible to users across an organization, often residing on edge or internal network segments accessible to remote workers. Given its role as a centralized web portal, it is commonly exposed or reachable within enterprise network environments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves Ivanti Xtraction, a reporting and dashboarding application. An attacker with valid credentials could redirect application requests to a malicious endpoint, potentially stealing sensitive connector credentials. The main concern is confirming relevance and exposure of this particular system within your environment.

Attackers can steal credentials via redirected requests.
This could expose sensitive system connections.
Assess Ivanti Xtraction systems for potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with existing access to Ivanti Xtraction could craft a request to trick the application into sending sensitive information, such as EPMM connector credentials, to a location controlled by the attacker. This could be achieved by manipulating file name or path inputs within the application, leading to a redirection of outgoing requests. The vulnerability allows an attacker to potentially gain further access or control by obtaining these credentials.

Authenticated user access required.
Unsanitized input redirects application requests.
Credential theft, potential further compromise.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in Ivanti Xtraction could allow a logged-in attacker to trick the application into sending sensitive EPMM connector credentials to an endpoint they control. This could happen when the application processes user-supplied information that dictates where it sends generated requests.

EPMM connector credentials.
Attacker manipulates application requests.
Credentials could be exposed to the attacker.

Operational Fix

Recommended remediation, mitigation, and detection steps

In a real-world scenario, ownership of this vulnerability likely resides with the application owner or platform team responsible for Ivanti Xtraction. The immediate first step is to determine the extent of the deployment, identify business-critical instances, and confirm the accountable owner. This information will inform the subsequent risk assessment and remediation planning, potentially involving coordination with security and network teams.

Application owner or platform team.
Verify affected instances and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Ivanti Xtraction?

Ivanti Xtraction is a reporting and dashboarding application used by organizations to visualize data. It typically functions as a centralized web-based service, allowing users across an enterprise to access insights from various connected systems, such as EPMM, through a single portal.

What does this CVE-2026-106042 vulnerability mean?

This is an External Control of File Name or Path vulnerability, identified as CWE-73. It means the application fails to properly validate user-supplied file paths or names. An attacker can exploit this weakness to manipulate the application into sending data to an unauthorized destination instead of the intended system.

How does an attacker trigger this vulnerability?

An attacker must already have authenticated access to the Ivanti Xtraction application to trigger this issue. It is not triggered by casual web traffic or unauthenticated requests; the attacker must be able to craft specific inputs that manipulate the application's path-handling logic to redirect its outgoing requests.

How does Halo Surface Signal categorize this risk?

Halo Surface Signal identifies Ivanti Xtraction as a web-based service commonly reachable within enterprise environments. Because it often sits on network segments accessible to remote workers or at the network edge, the service may be reachable by a wider range of users, increasing the relevance of this vulnerability.

What should I do if I manage Ivanti Xtraction?

Begin by identifying all instances of Ivanti Xtraction within your environment and confirming who owns each deployment. Once you have an inventory, prioritize business-critical systems for review. Engage with your security and platform teams to plan the necessary updates to version 2026.4 or later to resolve the underlying weakness.

References

hub.ivanti.com/s/article/Security-Advisory-Ivanti-Xtraction-Multiple…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.