Forwarded Taiwan Computer Network Crisis Coordination Center Cybersecurity Information Alert TWCERTCC-200-202610-00000015

[Description]
Xtraction, a product under Ivanti, is an IT reporting and data visualization platform that integrates data from different IT systems into a single dashboard for convenient real-time viewing and analysis. Recently, Ivanti released a critical security vulnerability advisory (CVE-2026-106042, CVSS: 9.9). This vulnerability allows an authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain the EPMM connector credentials transmitted by the application.

[Affected Platforms]
Ivanti Xtraction versions 2026.2.1 and earlier (including 2026.2.1)

[Recommended Measures]
Please update to Ivanti Xtraction version 2026.4 or later (including 2026.4).

[References]
1. https://www.twcert.org.tw/tw/cp-169-11279-6c31b-1.html