CVE-2026-106042

Executive Summary

CVE-2026-106042 is an external control of file name or path flaw (CWE-73) in Ivanti Xtraction affecting versions before 2026.4, rated CVSS 9.9. An authenticated remote attacker can manipulate a file name/path value that the application subsequently uses in an outbound request, redirecting application-generated traffic to an attacker-controlled endpoint and causing EPMM connector credentials to be transmitted to that endpoint. Any organization running Ivanti Xtraction (typically paired with Ivanti EPMM/Neurons for MDM for fleet management and reporting) should treat the exposed integration credentials as a high-value target given the score's "Changed" scope and high confidentiality, integrity, and availability subscores.

Technical Analysis

The vulnerability class is CWE-73: External Control of File Name or Path. The defining characteristic is that the application accepts a name or path value from an external source (here, an authenticated user's input) and uses it without sufficient validation or restriction. In the specific case described by NVD, the tainted value influences an application-generated request, such that the request is redirected to an attacker-chosen endpoint rather than the intended destination.

Because the NVD description does not enumerate the specific parameter, form field, API route, or configuration surface through which the path value is supplied, no such identifiers are asserted here. The following is what is derivable:

• The vulnerability is reachable by a remote attacker who holds valid authentication to the application (PR:L).
• Exploitation requires no user interaction on the part of a victim other than the attacker acting under their own account (UI:N).
• The consequence is transmission of EPMM connector credentials — secrets the application uses when communicating with Ivanti Endpoint Manager Mobile — to an endpoint controlled by the attacker (C:H).
• The tainted data path is application-controlled: "application-generated requests" are redirected, meaning the vulnerable code constructs and dispatches a request whose destination or structure is influenced by the externally supplied file name/path.
• Scope is changed (S:C), consistent with the successful theft of credentials granting access to a separate security-relevant component (EPMM) beyond Xtraction itself.
• Impact is complete across confidentiality, integrity, and availability, consistent with an attacker acquiring connector credentials that permit authenticating as the application to downstream infrastructure.

Two plausible but not confirmed mechanisms are consistent with CWE-73 and the redirection outcome: (a) poisoning of a path value that the application concatenates into a request URL/host, and (b) manipulation of a stored or referenced file/path entry (for example, a connector configuration reference) that is later dereferenced during request generation. Neither is stated in the source data; analysts should validate which mechanism applies against the affected release before building detections around a specific artifact.

There is no public PoC, no Nuclei template, and no exploit code tracked. No EPSS score is available (not yet scored by FIRST.org at the time of writing). The vulnerability is not listed in CISA KEV.

Exploitation Scenarios

The following chain is inferred strictly from the vulnerability class and the NVD description. No public PoC exists; specific payload syntax, parameter names, and request formats are intentionally not asserted.

1. Reconnaissance / target identification. An attacker with a foothold on or access to a network exposing Ivanti Xtraction enumerates the application and acquires or identifies valid low-privilege credentials (the flaw requires authentication but not elevated privilege). The attacker profiles whether the instance is configured with an EPMM connector, since the credential theft depends on that integration being present and active. Shodan-style discovery of internet- or VPN-reachable Xtraction instances supports mass identification of candidate targets.

2. Triggering the flaw. Under an authenticated session, the attacker supplies a crafted file name or path value into the externally controllable input that the application consumes when building an application-generated request. The value causes the application's request to be directed toward an attacker-controlled endpoint rather than the legitimate EPMM destination. The trigger is the act of submitting the tainted name/path — no victim interaction is required.

3. Credential capture. Because the application generates the request using its own stored connector configuration, the EPMM connector credentials are included in the outbound traffic and are delivered to the attacker-controlled endpoint. The attacker does not need to crack anything; they receive the secret directly as a result of the redirect.

4. Post-exploitation impact. With valid EPMM connector credentials in hand, the attacker pivots into the EPMM/mobile-management plane that Xtraction was authorized to reach. This aligns with the Changed-scope rating: the compromise extends beyond Xtraction to the integrated system. Downstream abuse could include unauthorized access to managed-device data, enrollment/management functions, or further lateral movement, and could combine with availability impact if connector-driven operations are disrupted. Credential reuse against other Ivanti services is a realistic follow-on given the high value and scope characteristics.

Note: The precise input surface, request construction logic, and endpoint selection logic are not documented in the provided data; the above stays at the vulnerability-class level rather than fabricating implementation details.

Impact Assessment

CVSS 3.1 base score is 9.9 (Critical). Subscores:

• AV:N — exploitable over the network.
• AC:L — no special conditions beyond a valid authenticated session.
• PR:L — any authenticated user, including low privilege, can trigger it.
• UI:N — no victim interaction.
• S:C — the compromise crosses a trust boundary, affecting the EPMM side in addition to Xtraction.
• C:H / I:H / A:H — total loss of confidentiality, integrity, and availability.

Business impact: theft of EPMM connector credentials can expose mobile-device management infrastructure to unauthorized access, threatening managed device data, configuration integrity, and the availability of management operations. The affected integration typically sits in a privileged position relative to enterprise mobility, giving a stolen connector secret disproportionate value. Blast radius extends from any authenticated user of Xtraction into the EPMM environment it connects to. Because the flaw is unpatched in tracked sources (patch confidence 0/4), every deployment below 2026.4 that has an active EPMM connector should be considered at risk until version 2026.4 is confirmed deployed and the leaked credentials are rotated.

Detection Guidance

Sigma Rule

title: Ivanti Xtraction External Control of File Name or Path (CVE-2026-106042)
id: 8f3c1a2e-9d4b-4c7a-b1e2-7a6c5f0d9e33
status: experimental
description: Detects authenticated requests to Ivanti Xtraction that supply path/file-name values potentially redirecting application-generated requests to attacker-controlled endpoints.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106042
author: detection-engineering
date: 2026-01-01
logsource:
  category: webserver
  product: ivanti
detection:
  selection_app:
    cs-uri-query|contains:
      - 'Xtraction'
  selection_pathmarkers:
    cs-uri-query|contains:
      - 'http://'
      - 'https://'
      - '//'
      - '../'
      - '..\\'
      - '%2f%2f'
  selection_epmm:
    cs-uri-query|contains:
      - 'epmm'
      - 'connector'
  condition: selection_app and (selection_pathmarkers or selection_epmm)
fields:
  - c-ip
  - cs-username
  - cs-uri
  - cs-uri-query
falsepositives:
  - Legitimate administrative use of absolute URLs in integration configuration
level: high

YARA Rule

rule CVE_2026_106042_Ivanti_Xtraction_Path_Redirect
{
    meta:
        description = "Detects indicators consistent with external control of file name or path in Ivanti Xtraction integration requests toward EPMM connectors"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106042"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $xt  = "Xtraction" ascii wide nocase
        $epmm = "EPMM" ascii wide nocase
        $conn = "connector" ascii wide nocase
        $s1 = "http://" ascii wide nocase
        $s2 = "https://" ascii wide nocase
        $trav1 = "../" ascii
        $trav2 = "..\\" ascii

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F
        and $xt
        and ($epmm or $conn)
        and 1 of ($s1, $s2, $trav1, $trav2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106042 Ivanti Xtraction possible request redirect via path injection"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"Xtraction"; nocase; http.uri; content:"http"; nocase; distance:0; sid:2026106042; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-106042; classtype:attempted-user; reference:cve,CVE-2026-106042;)

alert http any any -> any any (msg:"CVE-2026-106042 Ivanti Xtraction EPMM connector path traversal attempt"; flow:established,to_server; http.uri; content:"epmm"; nocase; http.uri; content:"../"; nocase; within:64; sid:2026106043; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-106042; classtype:attempted-user; reference:cve,CVE-2026-106042;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.action == "network_flow" and
      url.path contains "Xtraction" and
      url.query : ("http://*" or "https://*" or "*../*" or "*%2f%2f*") ]
  [ network where event.action == "network_flow" and
      url.path : ("*epmm*" or "*connector*") ]

Splunk SPL Query

index=web sourcetype=ivanti:xtraction OR sourcetype=access_combined
| search uri_path="*Xtraction*"
| eval suspicious=if(match(uri_query, "(?i)(https?://|%2f%2f|\.\./|\.\.\\\\)"), 1, 0)
| where suspicious=1 OR match(uri_query, "(?i)(epmm|connector)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_query) as queries by src_ip, user
| sort - count

Wazuh OSSEC Rule

<group name="ivanti_cve_2026_106042,">
  <rule id="1060420" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.?(Xtraction)</field>
    <field name="query">(?i)(https?://|%2f%2f|\.\./|\.\.\\)</field>
    <description>CVE-2026-106042: Ivanti Xtraction external control of file name/path - possible request redirect to attacker endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="1060421" level="14">
    <decoded_as>json</decoded_as>
    <field name="url">\.?(Xtraction)</field>
    <field name="query">(?i)(epmm|connector)</field>
    <description>CVE-2026-106042: Ivanti Xtraction EPMM connector path manipulation attempt</description>
    <mitre>
      <id>T1552</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Confirm whether each Ivanti Xtraction instance has an active EPMM connector. Where the connector is not operationally required, disable it to remove the exploit's payoff.
• Treat all EPMM connector credentials on instances below 2026.4 as potentially compromised. Rotate EPMM connector secrets as a precautionary measure, prioritizing internet- or VPN-reachable deployments and any instance used by a broad or untrusted user base.
• Restrict network egress from Xtraction to only the legitimate EPMM endpoint(s) at the firewall/proxy/allowlist layer, so that requests redirected to attacker-controlled hosts cannot leave the environment. This directly interrupts the credential-exfiltration step.
• Tighten authentication and role assignment so that only necessary accounts can access integration/configuration surfaces, reducing the pool of PR:L attackers.
• Hunt logs for outbound connections to unexpected hosts originating from the Xtraction server and for the detection rules above.

2. Patch / upgrade steps

• The NVD description states the issue is fixed in Ivanti Xtraction 2026.4. Upgrade to 2026.4 or later.
• Because no vendor advisory or patch source is currently tracked (Patch Sources empty, Vendor Fix N/A), verify the fix status and any required intermediate versions directly with Ivanti before relying on the version boundary alone.
• After upgrading, rotate EPMM connector credentials that may have been exposed.

3. Long-term hardening

• Apply allowlisting and request-destination validation to any code path where an externally supplied file name or path influences an outbound request (CWE-73 class control).
• Adopt egress filtering and egress logging from integration servers to managed-mobility infrastructure.
• Manage connector/service credentials as short-lived, rotatable secrets with monitoring for anomalous use.
• Track Ivanti security advisories and monitor for KEV status changes; integrate affected-version data into asset management so future CVEs in Xtraction/EPMM are triaged quickly.
• Since no PoC or KEV listing exists yet, do not deprioritize: the CVSS 9.9 and Changed-scope rating warrant prompt action ahead of public exploit availability.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106042
• CWE-73: External Control of File Name or Path: https://cwe.mitre.org/data/definitions/73.html
• CVSS 3.1 specification: https://www.first.org/cvss/v3.1/specification-document
• Ivanti Security Advisories portal (vendor advisory location to verify 2026.4 fix): https://www.ivanti.com/security
• CISA KEV catalog (current listing: not present): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns, exploit-in-the-wild evidence, public PoC, or Nuclei template are known for CVE-2026-106042 at the time of writing. EPSS is not yet scored by FIRST.org.