Vulnerability in Ivanti Xtraction

[ Description ]Official description

An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log.

[ Fixes ]Fixes and patches

• Security bulletin: Ivanti october-2026-security-updateVendor patch or bulletin · CERT-FR · ivanti.com/blog/october-2026-security-update, cited by CERT-FR CERTFR-2026-AVI-1311
• Security bulletin: Ivanti Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935Vendor patch or bulletin · CERT-FR · forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CV, cited by CERT-FR CERTFR-2026-AVI-1311
• Security bulletin: Ivanti Security-Advisory-Ivanti-Xtraction-Multiple-CVEsVendor patch or bulletin · CERT-FR · forums.ivanti.com/s/article/Security-Advisory-Ivanti-Xtraction-Multipl, cited by CERT-FR CERTFR-2026-AVI-1311
• Security bulletin: Ivanti Security-Advisory-Ivanti-Neurons-Patch-for-Intune-October-2026Vendor patch or bulletin · CERT-FR · forums.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-Patch-for, cited by CERT-FR CERTFR-2026-AVI-1311

[ Advisories ]Government CERT advisories

• CERT-FR14 Oct 2026CERTFR-2026-AVI-1311

  Multiple vulnerabilities in Ivanti products Translated from French

  Multiple vulnerabilities have been discovered in Ivanti products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and a breach of data confidentiality. Ivanti reports that…

  CVE-2026-104935CVE-2026-106047CVE-2026-106035+4 more CVEs

[ References ]References

• hub.ivanti.com/s/article/Security-Advisory-Ivanti-Xtraction-Multiple-CVEs