CVE-2026-106042

waiting for further signals

GHSA-2j2w-7xjw-cw32 ↗EUVD-2026-98848 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

Ivanti Xtraction

CWE-73 External Control of File Name or Path

ETK-2026-1482, permanent identifier

cvss9.9cna vendorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

6d 07h 38msince last run

12mAI analysis

timeline

0 = trigger signal

trigger signal (cve.org) +0hwaiting for further signals+29h

+2h

+4h

+6h

+8h

+10h

description

Ivanti Xtraction versions before 2026.4 are affected by an external control of file name or path issue. An authenticated remote attacker can cause application-generated requests to be sent to an attacker-controlled endpoint and obtain transmitted EPMM connector credentials.

mitigation

Upgrade Ivanti Xtraction to version 2026.4 or later. Restrict access to authenticated Xtraction accounts until the upgrade is complete.

check

exploit

automation

contextual

auth required

yes, low privileges

EPSS

0.79%55th percentile

agent run time

12m

cve.org record, t = 0

2026-10-13 16:12Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual: an exploit technique exists, but no deterministic check could cover this one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-13 16:12Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-106042
2026-10-13 17:33Z
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
thehackernews · https://thehackernews.com/2026/10/attacker-chains-three-ivanti-connect.html

this entry in the feed

GET /api/v1/feed/CVE-2026-106042

{
  "etk_id": "ETK-2026-1482",
  "cve_id": "CVE-2026-106042",
  "display_id": "CVE-2026-106042",
  "ghsa_id": "GHSA-2j2w-7xjw-cw32",
  "euvd_id": "EUVD-2026-98848",
  "status": "published",
  "anchor_state": "anchored",
  "title": "External control of file path in Ivanti Xtraction",
  "summary": "Ivanti Xtraction versions before 2026.4 are affected by an external control of file name or path issue. An authenticated remote attacker can cause application-generated requests to be sent to an attacker-controlled endpoint and obtain transmitted EPMM connector credentials.",
  "mitigation": "Upgrade Ivanti Xtraction to version 2026.4 or later. Restrict access to authenticated Xtraction accounts until the upgrade is complete.",
  "vendor": "Ivanti",
  "product": "Xtraction",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Xtraction",
      "purl": null
    }
  ],
  "cwes": [
    73
  ],
  "cvss_score": 9.9,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": 0.0079,
  "epss_percentile": 0.555,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 11.589398333333333,
  "t0_at": "2026-10-13T16:12:00.920000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-13T16:12:00.920000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T16:12:00.920000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106042"
    }
  }
}

published 2026-10-13 16:56Z
last change 2026-10-21 04:45Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.