Information Exposure Vulnerability in Ivanti Xtraction Cloud Sync
CVE-2026-106035

5.5MEDIUM

Key Information:

Vendor

Ivanti
Status
Xtraction
Vendor
CVE Published:
13 October 2026

What is CVE-2026-106035?

An Information Exposure vulnerability exists in Ivanti Xtraction Cloud Sync prior to version 2026.4, enabling a remote authenticated attacker to access sensitive information. This flaw allows the disclosure of partial SQL database passwords through the application’s log files, posing significant security risks that can be exploited to gain unauthorized access to affected systems.

Affected Version(s)

Xtraction 2026.4

References

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.