PatchTheCVExtraction vulnerabilities and fixes
Recent CVEs affecting xtraction, with upgrade or downgrade steps. 2 tracked.
xtraction has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-07-14. Highest priority: CVE-2026-14903 (score 44/100).
- CVE-2026-14903 HIGH 7.7 UPGRADE Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arb
- CVE-2026-14902 MEDIUM 4.0 UPGRADE An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redir
FAQ
How do I fix xtraction vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is xtraction being exploited right now?
None of the tracked xtraction CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which xtraction CVE should I patch first?
CVE-2026-14903 currently ranks highest (44/100): Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arb.