A missing authentication check in Ivanti Xtraction before version 2026.4 lets an attacker who can reach the system over the network create or modify entries that the software regards as trusted. The flaw is an instance of improper authentication or authorization (CWE‑306) and directly compromises the integrity of the system’s trust decisions, allowing an unauthenticated user to alter the trusted site list without permission.

The affected product is Ivanti Xtraction. All installations of the software that run versions earlier than 2026.4 contain the vulnerability. No additional vendor or product variants are listed in the advisory.

The CVSS score of 7.5 classifies the flaw as high severity. There is no EPSS score available, so the documented likelihood of exploitation is unknown, but the flaw can be exploited by a remote unauthenticated attacker, which makes it attractive as a low‑barrier attack vector. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploitation, but the nature of the flaw warrants a cautious stance. Attackers can exploit it by sending crafted requests to the Xtraction API endpoints that lack proper authentication checks.