CVE-2026-8043: Ivanti Xtraction Information Disclosure

CVE-2026-8043 Overview

CVE-2026-8043 is an external control of file name vulnerability in Ivanti Xtraction before version 2026.2. The flaw allows a remote authenticated attacker to read sensitive files from the underlying system and write arbitrary HTML files into a web-accessible directory. Successful exploitation can lead to information disclosure and enables client-side attacks against users who load the attacker-controlled HTML. The weakness is tracked under [CWE-73: External Control of File Name or Path]. Ivanti has published a security advisory and addressed the issue in Xtraction version 2026.2.

Critical Impact
An authenticated attacker can read sensitive files on the Xtraction server and plant arbitrary HTML in the web root, enabling data theft and browser-based attacks against legitimate users.

Affected Products

Ivanti Xtraction versions prior to 2026.2
Deployments where authenticated users can reach file-handling endpoints
Web-facing Xtraction instances accessible over the network

Discovery Timeline

2026-05-12 - CVE-2026-8043 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-8043

Vulnerability Analysis

The vulnerability arises because Ivanti Xtraction accepts a file name or path value supplied by an authenticated client and uses it in file system operations without sufficient validation. Because the application controls neither the source directory nor the target directory, the attacker can influence which file is read and where output is written. This yields two distinct primitives in a single flaw: arbitrary file read and arbitrary HTML write to a web directory.

The read primitive exposes configuration files, credentials, tokens, and business data stored on the server. The write primitive allows the attacker to drop HTML content into a directory served by the application's web tier. When other authenticated users request the planted file, their browsers execute the attacker's markup and JavaScript in the application's origin. This chains into session theft, cross-site scripting, and phishing within a trusted domain.

The attack is conducted over the network and requires only low-privileged authenticated access. No user interaction is needed for the file read or write itself, although client-side payloads rely on a victim loading the planted HTML.

Root Cause

The root cause is improper neutralization of externally supplied file path input passed to file I/O routines. The application trusts the client-provided name and does not constrain it to an allow-listed directory or sanitize traversal sequences. This is the defining condition of [CWE-73].

Attack Vector

An attacker authenticates to Xtraction with valid credentials, then submits a crafted request to a vulnerable endpoint that takes a file name parameter. By supplying a traversal path, the attacker redirects the read operation to sensitive files outside the intended directory, or redirects the write operation into a web-served path with an .html extension. No verified public proof-of-concept code is available at the time of writing. Refer to the Ivanti Security Advisory CVE-2026-8043 for vendor-specific technical context.

Detection Methods for CVE-2026-8043

Indicators of Compromise

Unexpected .html files appearing in Xtraction web directories with recent timestamps and unusual authorship.
HTTP requests to Xtraction endpoints containing path traversal sequences such as ../ or absolute paths in file-name parameters.
Authenticated sessions issuing file-handling requests at volumes or times inconsistent with normal reporting use.
Outbound connections from user browsers to attacker infrastructure after loading Xtraction-hosted pages.

Detection Strategies

Inspect Xtraction application logs for file-name parameters that reference paths outside expected report directories.
Compare the contents of Xtraction web-served directories against a known-good baseline to identify unauthorized HTML files.
Correlate authenticated user activity with file read and write operations on the server using endpoint and file integrity telemetry.

Monitoring Recommendations

Enable verbose request logging on the Xtraction web tier and forward logs to a centralized analytics platform.
Alert on writes to web-served directories by the Xtraction application service account outside of upgrade windows.
Monitor for reads of sensitive files such as configuration, credential stores, and registry hives by the Xtraction process.

How to Mitigate CVE-2026-8043

Immediate Actions Required

Upgrade Ivanti Xtraction to version 2026.2 or later as directed in the vendor advisory.
Audit Xtraction web directories for unauthorized .html files and remove any that cannot be attributed to legitimate activity.
Rotate credentials, API tokens, and secrets that may have been stored on or accessible to the Xtraction host.
Review authentication logs and revoke any user accounts showing suspicious file-handling activity.

Patch Information

Ivanti has released a fix in Xtraction version 2026.2. Apply the update following vendor guidance in the Ivanti Security Advisory CVE-2026-8043. Validate the upgrade by confirming the installed build matches the patched release.

Workarounds

Restrict network access to the Xtraction application so that only trusted user populations can authenticate.
Enforce least-privilege roles within Xtraction and remove standing access for accounts that do not require it.
Place a web application firewall in front of Xtraction with rules that block path traversal patterns in request parameters.
Run the Xtraction service under an account with no write permission to directories outside its required working paths.

bash

# Configuration example: WAF rule pattern to block traversal in file-name parameters
# (Adapt to your WAF syntax; this illustrates the matching logic only.)
SecRule ARGS_NAMES "@rx (?i)(file|path|name|report)" \
  "chain,deny,status:403,id:1008043,msg:'Possible CVE-2026-8043 traversal'"
  SecRule ARGS "@rx (\.\./|\.\.\\|%2e%2e[/\\]|^/|^[a-zA-Z]:\\\\)" "t:none,t:urlDecodeUni"