CERTFR-2026-AVI-1311

vendorFRcertfr

FrançaisShown in its original language — a full translation is planned for a future version.

Multiples vulnérabilités dans les produits Ivanti

view advisory published 2026-10-14

A published security advisory; the vulnerabilities below are the ones it describes.

01

describes (7)

Related CVEs.

IDseverity exploitable
CVE-2026-109412US——
An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.
CVE-2026-106047US——
A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.
CVE-2026-106043US—OT elevated—
A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.
CVE-2026-106042US——
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests t…
CVE-2026-106035US——
An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database…
CVE-2026-106034US——
A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system.
CVE-2026-104935US—OT criticalKEV
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14…
02

references

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan