Source: Ministry of education information & communication security contingency platform
| Publication Number | TACERT-ANA-2026101510103535 | Publication Time | 2026-10-15 10:46:36 |
| Incident Type | ANA-Vulnerability Alert | Discovery Time | 2026-10-15 10:46:36 |
| Impact Level | Low | ||
| [Subject] 【Vulnerability Alert】Ivanti's Xtraction Has a High-Risk Security Vulnerability (CVE-2026-106042) |
|||
| [Content] Forwarded from TWCERTCC-200-202610-00000015 Ivanti's Xtraction is an IT reporting and data visualization platform that can integrate data from different IT systems into a single dashboard, making it convenient for real-time viewing and analysis. Recently, Ivanti issued an advisory regarding a critical security vulnerability (CVE-2026-106042, CVSS: 9.9). This vulnerability allows an authenticated attacker to redirect requests generated by the application to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application. Information Sharing Level: WHITE (Information content can be publicly disclosed) |
|||
| [Affected Platform] Ivanti Xtraction version 2026.2.1 and earlier (inclusive) |
|||
| [Recommended Actions] Please update to Ivanti Xtraction version 2026.4 or later (inclusive) |
|||
| [Reference] 1. https://www.twcert.org.tw/tw/cp-169-11279-6c31b-1.html |
|||