Skip to content
Sign in

Ivanti product

Xtraction

Alert
No Xtraction CVE is in the CISA KEV catalogue.

Tracked since 13 May · latest article 14 Oct · RSS · API

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 0 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date

No Xtraction CVE is in the CISA KEV catalogue.

Patch cadence and exploit odds

How often CISA adds Xtraction CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

CISA has not added a Xtraction CVE to KEV.

Fix listed

8 of 8 CVEs in coverage

Every CVE in coverage has a fix recorded.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-14903: 67.6th percentileCVE-2026-8043: 58.7th percentileCVE-2026-106042: 56.1th percentileCVE-2026-106047: 54.1th percentileCVE-2026-14902: 53.3th percentileCVE-2026-106043: 51.6th percentileCVE-2026-106034: 40.5th percentileCVE-2026-106035: 24.1th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-1490367.6
CVE-2026-804358.7
CVE-2026-10604256.1
CVE-2026-10604754.1
CVE-2026-1490253.3
CVE-2026-10604351.6
CVE-2026-10603440.5
CVE-2026-10603524.1

Coverage5 articles · all time

The latest 5 articles naming Xtraction, in the shared story grammar.

Full timeline
Quiet for 2 weekslast report 14 Oct5 articles3 outlets

5 articles from 3 outlets since 13 May. Quiet since 14 Oct.

Now13 May1914 Jul12 Oct17202326First reportSecurityWeek · 13 May, 09:49Picked up againafter 5 days quiet
  • Wed 13 May, 09:49 UTC. SecurityWeek, first report. Fortinet and Ivanti patch 18 flaws, including three critical bugs.
  • Mon 18 May, 12:12 UTC. The Hacker News, its first report on the story. Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws.
  • Wed 15 Jul, 11:52 UTC. SecurityWeek. Fortinet, Ivanti and ServiceNow patch unauth RCE and other flaws.
  • Tue 13 Oct, 16:24 UTC. SecurityOnline, its first report on the story. Ivanti flaws expose Intune and Xtraction credentials, prompting secret rotation.
  • Wed 14 Oct, 08:01 UTC. SecurityWeek. Citrix, Fortinet and Ivanti Patch Critical Flaws, Exploited Zero Day.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 5 articles as a list
  1. Wed 13 MayDay 01
    1. Fortinet and Ivanti patch 18 flaws, including three critical bugs09:49 · SecurityWeek · First report

  2. Quiet for 5 days

    Mon 18 MayDay 51
    1. Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws12:12 · The Hacker News · Picked up again

  3. Quiet for 8 weeks

    Wed 15 JulDay 631
    1. Fortinet, Ivanti and ServiceNow patch unauth RCE and other flaws11:52 · SecurityWeek · Picked up again

  4. Quiet for 13 weeks

    Tue 13 OctDay 1531
    1. Ivanti flaws expose Intune and Xtraction credentials, prompting secret rotation16:24 · SecurityOnline · Picked up again
  5. Wed 14 OctDay 1541
    1. Citrix, Fortinet and Ivanti Patch Critical Flaws, Exploited Zero Day08:01 · SecurityWeek

All CVEs in coverage8

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-14903

    ivanti Xtraction vulnerability

    7.7High1.2% EPSS · 1 article
  • CVE-2026-8043

    ivanti Xtraction vulnerability

    9.6Critical0.9% EPSS · 2 articles
  • CVE-2026-106042

    Ivanti Xtraction vulnerability

    9.9Critical0.8% EPSS · 2 articles
  • CVE-2026-106047

    Ivanti Xtraction vulnerability

    7.7High0.7% EPSS · 1 article
  • CVE-2026-14902

    ivanti Xtraction vulnerability

    4.0Medium0.7% EPSS · 1 article
  • CVE-2026-106043

    Ivanti Xtraction vulnerability

    7.5High0.7% EPSS · 1 article
  • CVE-2026-106034

    Ivanti Xtraction vulnerability

    5.0Medium0.5% EPSS · 1 article
  • CVE-2026-106035

    Ivanti Xtraction vulnerability

    5.5Medium0.3% EPSS · 1 article
CyberSIXTSignal over noise
Updated AboutDevelopersSign in