Vulnerability intelligence
CVE-2026-8043
External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.
CVSS Score
9.6
Critical
EPSS — Exploit Probability
0.9%
Riskier than 55% of all CVEs
Exploitation
Not in CISA KEV
No federal exploitation record
Remediation
Patch available
Vendor fix published
2 articles across 2 outlets · first covered May 13, 2026 · latest May 18, 2026
Coverage timeline
-
Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flawsthehackernews.com · May 18, 2026
-
Fortinet and Ivanti patch 18 flaws, including three critical bugswww.securityweek.com · May 13, 2026