9.6

CVE-2026-8043

EPSS 0.09%
Veröffentlicht 12.05.2026 14:11:30
Zuletzt bearbeitet 13.05.2026 20:34:20
Quelle 3c1d8aa1-5a33-4ea4-8992-aadd64
CVE-Watchlists
Login
Unerledigt
Login

External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 4

NVD 1 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Ivanti ≫ Xtraction Version < 2026.2

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.09%	0.25

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
3c1d8aa1-5a33-4ea4-8992-aadd6440af75	9.6	3.1	5.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CWE-73 External Control of File Name or Path

The product allows user input to control or influence paths or file names that are used in filesystem operations.

https://hub.ivanti.com/s/article/Security-Advisory---Ivanti-Xtraction-CVE-2026-8043?language=en_US

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2026-8043

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2026-8043

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2026-8043

EUVD