9.6 CriticalCWE-73
CVE-2026-8043
ivanti Xtraction vulnerability
ivantiXtraction
Status
- Not in CISA KEV
- Fixed in version 2026.2
Exploit probabilityEPSSchecked 25 Oct
0.9%probability of exploitation in the next 30 days
Higher than 59% of scored CVEs
SeverityCVSS
9.6Critical
Description NVD
External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.
Coverage 2 articles · 2 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 13 May · 09:49 UTC | SecurityWeek | Fortinet and Ivanti patch 18 flaws, including three critical bugs |
| Mon 18 May · 12:12 UTC | The Hacker News | Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws |
- Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation FlawsThe Hacker News
- Fortinet and Ivanti patch 18 flaws, including three critical bugsSecurityWeek · first in our coverage · mentions it in passing