Loading story…
Ivanti released a security advisory for Ivanti Xtraction addressing two vulnerabilities affecting version 2026.2 and earlier: CVE-2026-14902, a medium-severity open redirect issue, and CVE-2026-14903, a high-severity path traversal flaw. Ivanti said the path traversal bug could allow an authenticated attacker to read arbitrary files outside the web root, while the open redirect issue could expose users to malicious redirection scenarios.
The vulnerabilities were fixed in Ivanti Xtraction 2026.2.1, and Ivanti said the issues were reported through its responsible disclosure program. The Canadian Centre for Cyber Security urged organizations to review Ivanti’s advisory and apply the necessary updates, while Ivanti said it was not aware of customer exploitation prior to public disclosure and directed customers to obtain the update through ILS.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On July 14, 2026, the Canadian Centre for Cyber Security published notice AV26-696 highlighting Ivanti's advisory for Ivanti Xtraction 2026.2 and prior. The notice urged users and administrators to review Ivanti's guidance and apply the necessary updates.
Ivanti stated that the vulnerabilities were fixed in Ivanti Xtraction version 2026.2.1 and advised customers to update via ILS. The fixes address an open redirect flaw and a high-severity path traversal issue that could let an authenticated attacker read arbitrary files outside the web root.
On July 14, 2026, Ivanti published a security advisory for CVE-2026-14902 and CVE-2026-14903 affecting Ivanti Xtraction 2026.2 and earlier. Ivanti said it was not aware of customer exploitation prior to public disclosure and that the issues were reported through its responsible disclosure program.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcehub.ivanti.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ivanti released security updates for multiple products, including **Endpoint Manager (EPM)**, **Xtraction**, **Virtual Traffic Manager (vTM)**, and **Secure Access Client for Windows**, prompting government cyber agencies in Canada and Belgium to urge immediate patching. The advisories cover several vulnerabilities, including `CVE-2026-8043` in Xtraction, `CVE-2026-8051` in vTM, `CVE-2026-7431` and `CVE-2026-7432` in Secure Access Client, and multiple issues in EPM. Reported impacts across the product set include local privilege escalation, sensitive data exposure, path traversal with arbitrary file write, OS command injection, credential leakage, and SQL injection that could lead to remote code execution.
Jun 29, 2026
Ivanti released security updates for two enterprise products, fixing multiple vulnerabilities in **Ivanti Secure Access Client for Windows** and **Ivanti Virtual Traffic Manager (vTM)**. In Secure Access Client, version `22.8R6` addresses **CVE-2026-7431**, an incorrect permissions issue that could let a local authenticated user read or modify sensitive log data; **CVE-2026-7432**, a race condition that could allow local privilege escalation to `SYSTEM`; and **CVE-2026-8992`, an improper certificate validation flaw that could enable remote unauthenticated code execution. Ivanti said affected Secure Access Client versions are `22.8R5` and earlier and advised customers to upgrade to `22.8R6`. Ivanti also patched **CVE-2026-8051** in **Ivanti Virtual Traffic Manager**, a high-severity `CWE-78` OS command injection vulnerability with a CVSS score of `7.2` that could allow a remote authenticated administrator to achieve remote code execution. The flaw affects vTM `22.9r3` and earlier and is fixed in `22.9r4`. Ivanti said it was not aware of customer exploitation of any of the disclosed issues before publication and said the vulnerabilities were reported through its responsible disclosure program, crediting William Söderberg of Reversec for the vTM finding.
Jun 29, 2026
Ivanti released security updates for **Ivanti Connect Secure**, **Policy Secure**, **ZTA Gateway**, and **Neurons for Secure Access** to fix four vulnerabilities, including two high-severity remote unauthenticated denial-of-service flaws tracked as `CVE-2025-5456` and `CVE-2025-5462`. The bugs stem from memory-safety weaknesses including a buffer over-read and a heap-based buffer overflow that can be triggered through crafted network input, potentially crashing appliances that provide VPN, zero-trust, and access-control services. Ivanti said cloud instances of Neurons for Secure Access were remediated by **August 2, 2025**, while on-premises customers must apply the fixed releases. The same advisory also addressed `CVE-2025-5466`, an authenticated administrator **XXE** issue that can cause denial of service, and `CVE-2025-5468`, a symbolic link handling flaw that could let a local authenticated attacker read arbitrary files. Ivanti said it had no evidence of customer exploitation before disclosure and that the issues were found through internal assessments and responsible disclosure, but the breadth of affected products increases operational risk for enterprises relying on Ivanti remote access infrastructure. The company also noted that **Pulse Connect Secure 9.x** no longer receives backported fixes because it has reached end of support.
Jun 29, 2026