CVE-2026-8043

9.6

Critical

Published:12 May 2026

Last updated:17 Jun 2026

Source:3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Analyzed

Weakness (CWE)

CWE-73CWE-73

CVSS Vector

v3.1

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: None

View on MITRE Find PoC on GitHub

Description

External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.

References

3c1d8aa1-5a33-4ea4-8992-aadd6440af75

https://hub.ivanti.com/s/article/Security-Advisory---Ivanti-Xtraction-CVE-2026-8043?language=en_US