CVE-2026-106035
5.5MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-532
Impact
Authenticated attackers can view partial SQL database passwords via application log files. They need an authenticated local or remote account with access to read the logs.
Root cause
The application writes sensitive SQL database passwords directly into its log files in cleartext.
Affected systems
Ivanti Xtraction Cloud Sync versions prior to 2026.4
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade Ivanti Xtraction Cloud Sync to version 2026.4 or later. If patching immediately is not possible, restrict filesystem and read permissions to application logs to prevent unauthorized access.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log.