【Vulnerability Alert】Ivanti's Xtraction Has a High-Risk Security Vulnerability (CVE-2026-106042)

publish date : 2026-10-22 update date : 2026-10-22

Source: Ministry of education information & communication security contingency platform


Publication Number	TACERT-ANA-2026101510103535	Publication Time	2026-10-15 10:46:36
Incident Type	ANA-Vulnerability Alert	Discovery Time	2026-10-15 10:46:36
Impact Level	Low
[Subject] 【Vulnerability Alert】Ivanti's Xtraction Has a High-Risk Security Vulnerability (CVE-2026-106042)
[Content] Forwarded from TWCERTCC-200-202610-00000015 Ivanti's Xtraction is an IT reporting and data visualization platform that can integrate data from different IT systems into a single dashboard, making it convenient for real-time viewing and analysis. Recently, Ivanti issued an advisory regarding a critical security vulnerability (CVE-2026-106042, CVSS: 9.9). This vulnerability allows an authenticated attacker to redirect requests generated by the application to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application. Information Sharing Level: WHITE (Information content can be publicly disclosed)
[Affected Platform] Ivanti Xtraction version 2026.2.1 and earlier (inclusive)
[Recommended Actions] Please update to Ivanti Xtraction version 2026.4 or later (inclusive)
[Reference] 1. https://www.twcert.org.tw/tw/cp-169-11279-6c31b-1.html

(This notification is for informational purposes only and does not constitute a cybersecurity incident).
If you have questions or suggestions regarding this notification, please feel free to contact us.
Ministry of education information & communication security contingency platform
Website: https://info.cert.tanet.edu.tw/
Phone: +886-7-5250211
Internet Phone: 98400000
E-Mail: service@cert.tanet.edu.tw

Organizer: Computer Center

Click Num:

Share