Key points
- CVE-2026-106042 is rated CVSS 9.9 Critical by the NVD.
- The flaw affects Ivanti Xtraction versions prior to 2026.4.
- Attackers must be authenticated to redirect requests and steal credentials.
Security teams managing Ivanti Xtraction infrastructure must address a high-severity flaw identified as CVE-2026-106042. The National Vulnerability Database rates this vulnerability 9.9, the highest possible score. The issue exists in all releases of Ivanti Xtraction before version 2026.4. Organizations running these older builds are exposed to credential theft if an attacker can authenticate to the system.
In plain English
The vulnerability is classified as External Control of File Name or Path, known as CWE-73. According to the NVD record, this flaw lets a remote attacker who has already logged in manipulate how the application handles file paths. By doing so, the attacker can redirect requests that the application generates internally. Instead of going to their intended destination, these requests are sent to a location controlled by the attacker.
The background
The primary risk is the compromise of sensitive authentication data. The source material specifies that the redirected requests allow the attacker to obtain EPMM connector credentials. These credentials are transmitted by the Ivanti Xtraction application during normal operations. Because the attacker controls the endpoint where these requests land, they can intercept and capture the credentials as they are sent. This means the stolen data is not just stored passwords, but active keys used for system connectivity.
What changes now
Version 2026.4 is the first release that addresses this specific path control issue. Any version released before that point remains vulnerable to this technique. There is no evidence in the source material that an older patch exists for this CVE. Users must plan their upgrade path carefully, knowing that the window of exposure remains open for all pre-2026.4 installations. The severity of the CVSS score reflects the ease with which an authenticated user can escalate their access by stealing these specific connector keys.
Who needs to act first
Teams usually prioritize systems that face the internet or internal networks with many users. Check whether your Ivanti instances are accessible to any authenticated personnel, including contractors. Reduce exposure by limiting who can log in while you plan the upgrade. Test the new version in a non-production environment first to ensure your custom configurations still work. Back up your current settings before making changes so you can revert if the update causes issues. Monitor logs for unusual request patterns that might indicate someone is trying to redirect traffic.
What to do and how to stay safe: Ivanti
- Audit user accounts to ensure only necessary personnel have authentication access to Ivanti Xtraction.
- Review network logs for unexpected external connections originating from the Xtraction application.
- Prepare a test environment to validate the installation of version 2026.4 before deploying it to production.
- Monitor for signs of credential misuse, such as unauthorized access to EPMM systems.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-106042?
The NVD rates the vulnerability as 9.9, which is classified as Critical.
Do attackers need to be authenticated to exploit this flaw?
Yes, the source material states the vulnerability allows a remote authenticated attacker to redirect requests.
Which versions of Ivanti Xtraction are affected?
All versions of Ivanti Xtraction before 2026.4 are affected by this vulnerability.
