Ivanti Xtraction Application Request Redirect and Credential Capture

CVE-2026-106042 is a CVSS 9.9 critical vulnerability in Ivanti Xtraction that allows an attacker to redirect application requests and capture credentials. The flaw was patched on October 14, 2026 as part of Ivanti’s October advisory batch.

Ivanti Xtraction is an analytics and reporting platform used in managed service provider environments to aggregate data from multiple Ivanti products, including asset management, service management, and endpoint management systems. The platform acts as an integration point that communicates with backend Ivanti services using stored credentials and authentication tokens.

In CVE-2026-106042, an attacker can cause the Xtraction application to redirect its outbound requests to an attacker-controlled destination, capturing the credentials or tokens the application sends in those requests. Because Xtraction is an integration platform with authenticated access to multiple Ivanti backend systems, the credential material it holds can provide access to multiple connected services beyond the Xtraction server itself.

The vulnerability was patched on October 14, 2026. Ivanti also patched CVE-2026-109412 (CVSS 9.9, Neurons Patch for Intune, authentication information leak) and CVE-2026-104935 (the actively exploited Connect Secure zero-day with a CISA October 16 deadline) in the same October cycle. Organizations running Xtraction in MSP environments should apply the patch and review integration credentials for evidence of prior exposure.

For broader context on Ivanti’s October patch batch, see Citrix, Fortinet, Ivanti Patch 29 CVEs on Patch Tuesday.

FAQ

Who uses Ivanti Xtraction?

Xtraction is primarily deployed in managed service provider environments and enterprises that use multiple Ivanti products. It aggregates data from Ivanti’s asset, service, and endpoint management platforms into unified reports and dashboards. Organizations not running Ivanti Xtraction are not affected by this CVE.

Is this exploited in the wild?

Not confirmed as of October 14, 2026. Unlike CVE-2026-104935, which Ivanti confirmed was actively exploited before the patch was released, CVE-2026-106042 is not described as exploited in the wild in the initial advisory. Apply the patch and review audit logs for anomalous outbound connections from the Xtraction server as a precaution.

Should we rotate credentials after patching?

If there is any possibility that Xtraction was internet-accessible before patching, reviewing and rotating the integration credentials it holds is prudent. A credential-capture flaw that went unpatched on a reachable server may have been exploited without leaving obvious signs. The patch closes the vulnerability; credential rotation closes the window of any prior exposure.