CVE-2026-106043: CWE-306 Missing authentication for critical function in Ivanti Xtraction

This vulnerability (CWE-306) in Ivanti Xtraction prior to version 2026.4 allows remote attackers to perform critical functions without authentication. Specifically, attackers can create or modify trusted sites, potentially impacting the integrity of the system. The CVSS 3.1 base score is 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality impact is none, but integrity impact is high, and availability is unaffected.

An unauthenticated remote attacker can create or modify trusted sites in Ivanti Xtraction, which may lead to unauthorized changes in system configuration or trust relationships. This could compromise the integrity of the system or data relying on trusted site configurations. There is no direct impact on confidentiality or availability reported.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to Ivanti Xtraction interfaces and monitor for unauthorized configuration changes.