This vulnerability (CVE-2026-14902) is classified as CWE-601, an open redirect issue in Ivanti Xtraction versions prior to 2026.2.1. It permits remote unauthenticated attackers to cause users to be redirected to arbitrary external URLs, potentially facilitating phishing or other social engineering attacks. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, scope changed, no confidentiality impact, low integrity impact, and no availability impact. No official fix or patch information is currently available.

The vulnerability allows attackers to redirect users to untrusted external websites, which can be used in phishing campaigns or to trick users into interacting with malicious sites. There is no direct confidentiality or availability impact, but the integrity impact is low due to the potential for misleading users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users and administrators should be cautious of unexpected redirects and consider implementing web filtering or user awareness measures to mitigate risks associated with open redirects.