CVE-2026-106035: CWE-532 Insertion of sensitive information into log file in Ivanti Xtraction

This vulnerability (CVE-2026-106035) affects Ivanti Xtraction Cloud Sync versions prior to 2026.4. It involves the insertion of sensitive information, specifically partial SQL database passwords, into application log files. An attacker with remote authenticated access can exploit this flaw to gain unauthorized disclosure of sensitive credentials. The weakness is categorized under CWE-532 (Insertion of Sensitive Information into Log File). The CVSS v3.1 base score is 5.5, reflecting a medium severity with attack vector local, low attack complexity, low privileges required, no user interaction, and high confidentiality impact.

The vulnerability allows disclosure of partial SQL database passwords to remote authenticated attackers via application logs. This exposure can lead to unauthorized access to database credentials, potentially compromising database confidentiality. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to application logs to authorized personnel only and monitor for unauthorized access. Avoid logging sensitive information in application logs as a temporary mitigation if possible.