Organisations face critical credential theft risk in Ivanti Xtraction prior to v2026.4
A critical flaw in Ivanti Xtraction lets authenticated attackers hijack requests to steal connector credentials, rated 9.9 by the US National Vulnerability Database.
Key points
- The flaw is classified as critical with a CVSS score of 9.9.
- Attackers must possess valid authentication credentials to exploit the issue.
- Versions of Ivanti Xtraction prior to 2026.4 are affected.
Malicious actors can steal EPMM connector credentials from Ivanti Xtraction systems by redirecting application requests. The vulnerability exists in versions of the software released before 2026.4. This flaw allows remote, authenticated attackers to hijack data transmissions intended for legitimate endpoints. According to the US National Vulnerability Database, the issue stems from inadequate control over file names or paths within the application.
How it unfolded
- The US National Vulnerability Database published a record for CVE-2026-106042.
- Analysts identified a CWE-73 weakness in Ivanti Xtraction code.
- The flaw was confirmed to affect all releases before version 2026.4.
Who is affected
Organisations running Ivanti Xtraction are exposed if they have not updated to version 2026.4 or later. The vulnerability requires the attacker to be authenticated to the system. This means an adversary must first obtain valid login credentials before they can redirect requests. Once authenticated, the attacker can force the application to send sensitive connector credentials to an endpoint they control. The US National Vulnerability Database rates this specific issue as critical, assigning it a CVSS score of 9.9.
The fix
No fix has been confirmed yet. The source material only states that versions before 2026.4 are vulnerable. It does not confirm that version 2026.4 has been released or that it contains a patch. Users should monitor official vendor channels for updates. Until a confirmed fix is available, systems remain vulnerable to credential theft via request redirection. The US National Vulnerability Database confirms that versions prior to 2026.4 contain the flaw.
What analysts watch for
Security teams usually monitor for anomalous outbound connections from authentication servers. Analysts check whether traffic is being redirected to unknown external IP addresses or domains. They examine logs for requests that deviate from standard application patterns. Teams also look for sudden spikes in credential validation attempts from unusual sources. Investigating these indicators helps detect if an attacker is manipulating request paths to intercept sensitive data. Regular review of network flow data is essential for spotting these subtle deviations.
What to do and how to stay safe: Ivanti
- Monitor official vendor channels for confirmation of a fix.
- Review authentication logs for requests that redirect to unexpected endpoints.
- Restrict access to the application to limit the number of potential attackers.
- Monitor network traffic for signs of data being sent to unauthorised servers.
Step-by-step guide: Patch Management: Eight Questions Answered for Stability
General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-106042?
It is a critical vulnerability in Ivanti Xtraction that allows authenticated attackers to steal credentials.
Which versions are affected?
All versions of Ivanti Xtraction before 2026.4 are vulnerable to this flaw.
How severe is the issue?
The US National Vulnerability Database rates it as critical with a CVSS score of 9.9.
