MDR
Solutions
Partners
About
Resources
Affected Environment
Ivanti Xtraction 2026.2.1 and prior, and the Ivanti Neurons Patch for Intune cloud service.
Threat Overview
Six CVEs, including two CVSS 9.9 flaws: CVE-2026-106042 in Xtraction and CVE-2026-109412 in Neurons Patch for Intune.
Exposure Timeline
Disclosed 13 October 2026; Xtraction 2026.4 fixes available; Neurons Patch for Intune cloud updated 16 September 2026.
Attack Surface
Xtraction web application, template export, Cloud Sync, trusted site functions, and an exposed Neurons Patch for Intune endpoint.
Technical Root Cause
Path traversal, external control of file path, missing authentication, log exposure, and an exposed dangerous endpoint.
Exploitation Pathway
Authenticated attackers redirect requests to capture connector credentials or read files; one flaw allows unauthenticated trusted site changes.
Operational Impact
Credential theft, arbitrary file access, directory modification, and unauthorised actions on Ivanti reporting and patching systems.
Strategic Impact
Leaked connector and authentication credentials could enable movement into connected endpoint management environments.
Required Mitigation
Upgrade Ivanti Xtraction to 2026.4 or later; confirm the Neurons Patch for Intune cloud update is applied.
Incident Response Guidance
Rotate EPMM connector and SQL credentials, review logs for suspicious requests, and audit trusted site and file system changes.
References
Ivanti Security Advisories.
Trusted by clients worldwide
Led by human expertise and powered by the VisionX platform, we provide you with a 24/7 unbeatable Managed Detection & Response capability giving you transparent and consolidated security solutions.
.jpg)