Vulnerability in Ivanti Xtraction

[ Description ]Official description

A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system.

[ Fixes ]Fixes and patches

• Security bulletin: Ivanti october-2026-security-updateVendor patch or bulletin · CERT-FR · ivanti.com/blog/october-2026-security-update, cited by CERT-FR CERTFR-2026-AVI-1311
• Security bulletin: Ivanti Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935Vendor patch or bulletin · CERT-FR · forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CV, cited by CERT-FR CERTFR-2026-AVI-1311
• Security bulletin: Ivanti Security-Advisory-Ivanti-Xtraction-Multiple-CVEsVendor patch or bulletin · CERT-FR · forums.ivanti.com/s/article/Security-Advisory-Ivanti-Xtraction-Multipl, cited by CERT-FR CERTFR-2026-AVI-1311
• Security bulletin: Ivanti Security-Advisory-Ivanti-Neurons-Patch-for-Intune-October-2026Vendor patch or bulletin · CERT-FR · forums.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-Patch-for, cited by CERT-FR CERTFR-2026-AVI-1311

[ Advisories ]Government CERT advisories

• CERT-FR14 Oct 2026CERTFR-2026-AVI-1311

  Multiple vulnerabilities in Ivanti products Translated from French

  Multiple vulnerabilities have been discovered in Ivanti products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and a breach of data confidentiality. Ivanti reports that…

  CVE-2026-104935CVE-2026-106047CVE-2026-106035+4 more CVEs

[ References ]References

• hub.ivanti.com/s/article/Security-Advisory-Ivanti-Xtraction-Multiple-CVEs