CVE-2026-106034
5.0MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-22
Impact
Authenticated attackers can create or modify arbitrary directories on the host file system. They need network access to Xtraction and valid low-privileged user credentials.
Root cause
A path traversal flaw allows directory manipulation outside the intended file path boundaries.
Affected systems
Ivanti Xtraction versions prior to 2026.4
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Fix & remediation
Upgrade Ivanti Xtraction to version 2026.4 or later. If upgrading must wait, restrict network access to trusted administrative networks and review authenticated account access.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system.