Zurück zur CVE-Übersicht
CVE-2026-106043
HIGH(7.5)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Risk Signal Score19/100 — NIEDRIG
- CVSS 7.5 — Hoch
Erwähnungen (letzte 60 Tage)
Artikel
EPSS-Score
0.7%
Exploit-Wahrscheinlichkeit (30 Tage)
CVSS Score
7.5
Technische Schwere
Beschreibung
A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.
Erkennung & Indikatoren
Ausnutzung
In den geprüften Quellen nicht genannt
Behobene Versionen
- Xtraction 2026.4
Threat-Hunting-Queries
Sentinel/Defender KQL
DeviceProcessEvents
| where InitiatingProcessFileName =~ "Xtraction.exe"
| where ProcessCommandLine contains "create" or ProcessCommandLine contains "modify" or ProcessCommandLine contains "trusted site"Splunk SPL
index=* sourcetype=Xtraction (create OR modify OR "trusted site")Sigma
title: Ivanti Xtraction Missing Authentication
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\Xtraction.exe'
CommandLine|contains|all:
- 'create'
- 'trusted site'
condition: selectionElastic ES|QL
from process where process.executable : "*\\Xtraction.exe" and (process.args : "create" or process.args : "modify" or process.args : "trusted site")SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.