Vulnerability in Ivanti Xtraction

[ Description ]Official description

A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.

[ Fixes ]Fixes and patches

• Security bulletin: Ivanti october-2026-security-updateVendor patch or bulletin · CERT-FR · ivanti.com/blog/october-2026-security-update, cited by CERT-FR CERTFR-2026-AVI-1311
• Security bulletin: Ivanti Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935Vendor patch or bulletin · CERT-FR · forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CV, cited by CERT-FR CERTFR-2026-AVI-1311
• Security bulletin: Ivanti Security-Advisory-Ivanti-Xtraction-Multiple-CVEsVendor patch or bulletin · CERT-FR · forums.ivanti.com/s/article/Security-Advisory-Ivanti-Xtraction-Multipl, cited by CERT-FR CERTFR-2026-AVI-1311
• Security bulletin: Ivanti Security-Advisory-Ivanti-Neurons-Patch-for-Intune-October-2026Vendor patch or bulletin · CERT-FR · forums.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-Patch-for, cited by CERT-FR CERTFR-2026-AVI-1311

[ Advisories ]Government CERT advisories

• CERT-FR14 Oct 2026CERTFR-2026-AVI-1311

  Multiple vulnerabilities in Ivanti products Translated from French

  Multiple vulnerabilities have been discovered in Ivanti products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and a breach of data confidentiality. Ivanti reports that…

  CVE-2026-104935CVE-2026-106047CVE-2026-106035+4 more CVEs

[ References ]References

• hub.ivanti.com/s/article/Security-Advisory-Ivanti-Xtraction-Multiple-CVEs