CVE-2026-14902: An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.

mediumCVSS 4CVE-2026-14902

An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: medium — CVSS 4
Published: 2026-07-14
Last updated: 2026-07-15
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-14902

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-149020.54% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-14902	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownIvanti security advisory (AV26-696)cccs

Recent advisories for An open redirect

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-62959: Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0…nvd · 2026-07-31
mediumCVE-2026-67350: Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unaut…nvd · 2026-07-31
highCVE-2026-10545: IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allow…nvd · 2026-07-30
mediumCVE-2026-66414: Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows una…nvd · 2026-07-30
mediumCVE-2026-18266: Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability. This vulnerability allows rem…nvd · 2026-07-29
mediumCVE-2026-53668: React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0…nvd · 2026-07-27