July 14, 2026
Ivanti Security Advisory · July 2026
Total
2
Critical
0
Zero-day
0
KEV
0
By product family
Unassigned2 CVEs
- CVE-2026-14903CVSS 7.7
Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.
- CVE-2026-14902CVSS 4.0
An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.