An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect…
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Ivanti
- Product
- ivanti
- CVSS
- 9.9
- EPSS
- 0.008 (p56)
- Exposure class
- Mobile OS
Why it ranks 29 (Notable)
- CVSS 9.9 critical
- Product class: mobile OS
- Widely deployed vendor product (Ivanti)
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.