轉發 台灣電腦網路危機處理暨協調中心 資安訊息警訊 TWCERTCC-200-202610-00000015

[內容說明]
Ivanti旗下的Xtraction是一套IT報表與資料視覺化平台，可將不同IT系統的資料整合至同一儀表板，方便即時查看與分析。近期Ivanti發布重大資安漏洞公告(CVE-2026-106042，CVSS：9.9)。此漏洞允許經身分驗證的攻擊者將應用程式產生的請求導向到攻擊者控制的端點，並取得應用程式傳輸的EPMM連接器憑證。

[影響平台]
Ivanti Xtraction 2026.2.1(含)以前版本

[建議措施]
請更新至Ivanti Xtraction 2026.4(含)之後版本

[參考資料]
1 https://www.twcert.org.tw/tw/cp-169-11279-6c31b-1.html
Forwarded Taiwan Computer Network Crisis Coordination Center Cybersecurity Information Alert TWCERTCC-200-202610-00000015

[Description]
Xtraction, a product under Ivanti, is an IT reporting and data visualization platform that integrates data from different IT systems into a single dashboard for convenient real-time viewing and analysis. Recently, Ivanti released a critical security vulnerability advisory (CVE-2026-106042, CVSS: 9.9). This vulnerability allows an authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain the EPMM connector credentials transmitted by the application.

[Affected Platforms]
Ivanti Xtraction versions 2026.2.1 and earlier (including 2026.2.1)

[Recommended Measures]
Please update to Ivanti Xtraction version 2026.4 or later (including 2026.4).

[References]
1. https://www.twcert.org.tw/tw/cp-169-11279-6c31b-1.html