Vulnerability Details CVE-2026-14902
An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 35.9%
CVSS Severity
CVSS v3 Score 4.0
Products affected by CVE-2026-14902
-
cpe:2.3:a:ivanti:xtraction:2021.1
-
cpe:2.3:a:ivanti:xtraction:2021.2
-
cpe:2.3:a:ivanti:xtraction:2021.3
-
cpe:2.3:a:ivanti:xtraction:2021.4
-
cpe:2.3:a:ivanti:xtraction:2022.1
-
cpe:2.3:a:ivanti:xtraction:2022.2
-
cpe:2.3:a:ivanti:xtraction:2022.3
-
cpe:2.3:a:ivanti:xtraction:2022.4
-
cpe:2.3:a:ivanti:xtraction:2023.1
-
cpe:2.3:a:ivanti:xtraction:2023.2
-
cpe:2.3:a:ivanti:xtraction:2023.3
-
cpe:2.3:a:ivanti:xtraction:2023.4
-
cpe:2.3:a:ivanti:xtraction:2024.1
-
cpe:2.3:a:ivanti:xtraction:2024.2
-
cpe:2.3:a:ivanti:xtraction:2024.3
-
cpe:2.3:a:ivanti:xtraction:2025.1
-
cpe:2.3:a:ivanti:xtraction:2025.2
-
cpe:2.3:a:ivanti:xtraction:2025.3
-
cpe:2.3:a:ivanti:xtraction:2025.4
-
cpe:2.3:a:ivanti:xtraction:2026.1
-
cpe:2.3:a:ivanti:xtraction:2026.2