CVE-2026-106042Vulnerability
Reported by 5 independent sources · first reported by Dark Web Informer · last reported
Last reported 10 days ago
higher than 55% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
5 reports, newest first · the exact sentence from each-
Múltiples vulnerabilidades en productos de Ivanti“CVE-2026-106042: vulnerabilidad de control externo del nombre o la ruta de archivos en Ivanti Xtraction.”
-
Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products“The Xtraction update fixes five issues, including a critical bug (CVE-2026-106042) that could allow attackers to redirect application-generated requests and capture EPMM connector credentials.”
-
Multiples vulnérabilités dans les produits Ivanti (14 octobre 2026)“Référence CVE CVE-2026-106042”
-
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far“Each has a flaw Ivanti rates 9.9 out of 10: CVE-2026-106042 in Xtraction before version 2026.4, and CVE-2026-109412 in Neurons Patch for Intune.”
-
Ivanti Patches Actively Exploited Connect Secure Zero-Day and Critical Credential-Leak Flaws“The most serious, CVE-2026-106042, has a CVSS score of 9.9.”
Indicators reported together
named in the same reports- 25.1.3[.]1in 3 reports
- 25.1.2[.]2in 2 reports
- 25.1.1[.]1in 2 reports
- 25.1.1[.]2in 2 reports
- 108.165.147[.]64in 1 report
- hxxps://www.ivanti[.]com/blog/october-2026-security-updatein 1 report
- hxxps://forums.ivanti[.]com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935in 1 report
- hxxps://forums.ivanti[.]com/s/article/Security-Advisory-Ivanti-Neurons-Patch-for-Intune-October-2026in 1 report
- hxxps://forums.ivanti[.]com/s/article/Security-Advisory-Ivanti-Xtraction-Multiple-CVEsin 1 report
Copy these 9 indicators · defanged
Also named with it: CVE-2026-104935, CVE-2026-109412, CVE-2026-106047, CVE-2026-106043, CVE-2026-106034, CVE-2026-106035, CVE-2026-106173, CVE-2026-107656
Thanks — we review every report.