CVE-2026-106042

Summary

An external control of file name or path vulnerability in Ivanti Xtraction allows authenticated attackers to redirect application requests and steal EPMM connector credentials, potentially leading to unauthorized access to connected systems.

Exploitability

Exploitation requires an authenticated user with access to the application, but is relatively straightforward once achieved as it involves crafting malicious paths that redirect requests to attacker-controlled endpoints.

Blast radius

If exploited, this vulnerability could allow attackers to gain access to EPMM connector credentials and potentially compromise all systems connected through those connectors, affecting a wide range of enterprise environments.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2026.4 or later to address the external control of file name or path vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.