{"id":"CVE-2026-106042","published":"2026-10-13T17:17:16Z","modified":"2026-10-14T16:08:15Z","title":"An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote…","vendor":"Ivanti","product":"Xtraction","tier":"core","eol":null,"description":{"text":"An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.","provenance":"source","from":"NVD"},"summary":{"text":"Ivanti Xtraction contains an external control of file name or path flaw (CWE: External Control of File Name or Path) in versions before 2026.4. The weakness lies in how the product handles request destinations, which is where the vulnerability resides. A remote attacker who holds valid authentication can redirect requests the application generates to an endpoint they control, causing the application to transmit EPMM connector credentials to that endpoint. No user interaction or special configuration is indicated; the attacker needs network access and low-privilege authenticated access.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:17:12Z"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00789,"percentile":0.56138,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":8,"pulses":[{"name":"Known_Cve | Oct 22, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad8d340ce8bef7ffa79b89b","created":"2026-10-21"},{"name":"Known_Cve | Oct 21, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad7813c340f998d3db4d0bb","created":"2026-10-20"},{"name":"Known_Cve | Oct 20, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad62f708ed98220bccde9c8","created":"2026-10-19"},{"name":"Known_Cve | Oct 19, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad4ddae89608f8a66f58915","created":"2026-10-18"},{"name":"Known_Cve | Oct 18, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad38c2e0aa0d5de6ee8bb52","created":"2026-10-17"},{"name":"Known_Cve | Oct 17, 2026 | Part 2/4","url":"https://otx.alienvault.com/pulse/6ad23ab69d40bd72818ecdae","created":"2026-10-16"},{"name":"Known_Cve | Oct 16, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ad0e93a078e6220a69919cf","created":"2026-10-15"},{"name":"Known_Cve | Oct 15, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6acf9878b4135e4a2037eb34","created":"2026-10-14"}],"provenance":"machine"},"cwes":[{"id":"CWE-73","name":"External Control of File Name or Path"}],"references":[{"url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Xtraction-Multiple-CVEs","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-98848","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98848","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106042","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":20.3,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":11.23,"detail":"percentile 0.5614"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":6.93,"detail":"base score 9.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}