This vulnerability is an instance of External Control of File Name or Path, described as CWE-73. An attacker with remote authenticated rights can influence the file path that the Ivanti Xtraction application uses to send requests. By redirecting those requests to an endpoint controlled by the attacker, the application inadvertently transmits EPMM connector credentials to the attacker. The effect is the theft of privileged credentials used to communicate with external management devices.

Ivanti Xtraction versions earlier than 2026.4 are affected. The vulnerability exists before the 2026.4 release and all earlier releases may allow the described redirection.

The CVSS score of 9.9 indicates a critical severity. EPSS data is not available, but the lack of a KEV listing does not mitigate the high intrinsic risk. The attack vector is remote, however it requires the attacker to possess authenticated credentials to the Xtraction system. Once authenticated, the attacker can manipulate request paths to redirect traffic to malicious endpoints and capture EPMM connector credentials that the application uses in its normal operation.