CVE-2026-106042: Ivanti Xtraction credential theft via path control

Critical vulnerability in Ivanti Xtraction pre-2026.4 enables EPMM credential theft via path control.

CVE-2026-106042 describes an External Control of File Name or Path vulnerability in Ivanti Xtraction versions before 2026.4. The flaw enables an authenticated attacker to redirect application-generated requests to attacker-controlled endpoints, allowing theft of EPMM connector credentials. This directly impacts administrators and operators managing mobile enterprise with Ivanti Xtraction.

With a CVSS score of 9.9, the vulnerability is rated critical. It was published on NVD on 2026-10-13 and continues to generate discussion in security communities: recent X posts mention CVE-2026-106042 as a relevant vulnerability for defense teams. No public exploit is currently confirmed, but the CVSS score demands immediate attention.

IT teams and CISOs must prioritize inventory of all Ivanti Xtraction instances in production, verify installed versions, and deploy updates to version 2026.4 or later. Concurrently, monitor logs for EPMM connector credential usage patterns to detect anomalies and verify configuration path integrity.

At a glance

What: External Control of File Name or Path vulnerability in Ivanti Xtraction. Allows authenticated attacker to redirect application-generated requests to attacker-controlled endpoints and steal EPMM connector credentials transmitted by the application.
Severity: CVSS 9.9 (Critical). Requires authentication but enables theft of critical credentials for mobile enterprise management.
Affected versions: Ivanti Xtraction versions before 2026.4. Fixed version is 2026.4 and later.
Fix: Update to Ivanti Xtraction version 2026.4 or later. Official patches available through Ivanti channels.
Status: Published on NVD on 2026-10-13. No public exploit confirmed. Recent X discussions indicate vulnerability relevance for defense teams.
Action: Sysadmins and CISOs must inventory Ivanti Xtraction instances in production, verify versions, deploy updates to 2026.4+. Monitor logs for EPMM connector credential usage to detect anomalies.

Sources: NVD, CVE-2026-106042

← All articles