Ivanti Xtraction CVE-2026-106042 (CVSS 9.9): authenticated attacker can redirect requests and steal EPMM connector credentials; upgrade to 2026.4 (CCC lists 2026.2.1 and prior as affected)

Ivanti disclosed CVE-2026-106042 on 13 October 2026 in Ivanti Xtraction: an external control of file name or path (CWE-73) that lets a remote authenticated attacker redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials the application transmits. OpenCVE and reporting rate it Critical 9.9 (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The Canadian Centre for Cyber Security advisory AV26-1035 lists Ivanti Xtraction 2026.2.1 and prior as affected; public CVE enrichment marks 2026.4 as unaffected. Ivanti's October security update points customers to the Xtraction multiple-CVE advisory and says it is not aware of exploitation for these product fixes. EPMM connector credentials are high value for mobile-device management integrations, so treat this as a credential-exposure priority alongside rotating any EPMM secrets after upgrade. Separate from the Connect Secure zero-day chain. Primary: Ivanti Xtraction multiple-CVE advisory; secondary: CCC AV26-1035 / OpenCVE.

Product

Ivanti Xtraction (EPMM connector credential handling)

Versions

Affected per CCC AV26-1035: Xtraction 2026.2.1 and prior. Remediation reported as upgrade to 2026.4 or later (OpenCVE marks 2026.4 unaffected). Rotate EPMM connector credentials after patching.

CVSS

9.9 (CVSS 3.1 Critical)

Exploited in Australia?

unknown

Patch to

Upgrade Ivanti Xtraction to 2026.4 or later per the vendor advisory, restrict outbound traffic from the Xtraction server to trusted EPMM endpoints until patched, and rotate EPMM connector credentials after the upgrade.

Primary: Ivanti — Security Advisory Ivanti Xtraction (Multiple CVEs) October 2026 · Vendor: Ivanti — October 2026 Security Update (13 Oct 2026) · CVE: CVE-2026-106042 · Canadian Centre for Cyber Security — Ivanti security advisory AV26-1035 (13 Oct 2026); also OpenCVE CVE-2026-106042

vulnerabilities identity cloud