CVE-2026-118527: Ivanti Connect Secure Vulnerability
Active exploitation confirmed in CISA KEV.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NActive exploitation confirmed in the wild. CISA added this to the KEV catalog on 2026-10-30. Federal agencies must patch by 2026-11-13.
TL;DR - CVE-2026-118527 lets a remote authenticated attacker upload content to a predictable filesystem location on Ivanti Connect Secure. - Affected versions are 25.1.1.2 and earlier, and 22.8R2.5 and earlier. Upgrade to 25.1.1.3 or 22.8R2.6. - Exploitation is confirmed, CISA KEV-listed, and requires immediate patching and forensic review.
CVE-2026-118527 is an actively exploited Ivanti Connect Secure vulnerability involving predictable filenames or identifiers during file handling. Although its CVSS score is medium, the confirmed exploitation, CISA Known Exploited Vulnerabilities (KEV) listing, and use in attack chains make affected appliances an urgent remediation priority.
Are You Affected?
CVE-2026-118527 affects Ivanti Connect Secure appliances that use predictable filenames or identifiers during file handling. The vulnerability is remotely exploitable over the network, but the published CVSS assessment requires low-level authentication. That requirement should not be treated as a meaningful safety barrier: reporting describes the flaw being used in attack chains involving other Ivanti Connect Secure vulnerabilities.
| Field | Details |
|---|---|
| CVE ID | CVE-2026-118527 |
| Product | Ivanti Connect Secure |
| Vulnerability | Generation of Predictable Numbers or Identifiers, CWE-340 |
| CVSS | 4.3 Medium |
| CVSS vector | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| Attack vector | Network |
| Authentication / privileges | Low privileges required |
| User interaction | None |
| Patch available | Yes |
| Fixed versions | 25.1.1.3 and 22.8R2.6 |
| Confirmed exploitation | Yes; listed in CISA KEV |
According to Ivanti’s advisory, the specifically affected ranges are Ivanti Connect Secure 25.1.1.2 and earlier and 22.8R2.5 and earlier. The vendor’s broader update materials reference additional related branch versions, but defenders should use the CVE-specific ranges above when determining whether this vulnerability applies to an appliance.
Inventory every Ivanti Connect Secure appliance, including appliances managed through distributed or hosted administration. Confirm the exact installed build instead of relying on major-version labels. Prioritize internet-facing appliances, then systems reachable from untrusted internal networks or used for remote access.
Analyst’s Take: The medium CVSS score does not match the operational priority here. Confirmed exploitation, CISA KEV listing, and documented attack-chain use make version validation and exposure review the first tasks for affected appliances.
The Fix, If You’re in a Hurry
Upgrade affected appliances to Ivanti Connect Secure 25.1.1.3 or 22.8R2.6, matching the appliance’s release branch. Ivanti makes updates available through the applicable Ivanti Neurons, download, or licensing portal. Confirm the downloaded package and follow the vendor’s installation and validation instructions for the deployment model in use.
Do not assume that an earlier Ivanti Connect Secure update resolves CVE-2026-118527. The fixed versions identified for this vulnerability are 25.1.1.3 and 22.8R2.6. After upgrading, verify the running build from the appliance administration interface or approved management tooling, and retain change records showing the installed version.
If immediate patching is not possible, follow Ivanti’s current mitigation instructions and reduce exposure while the upgrade is scheduled. Restrict management and administrative access to trusted networks, limit unnecessary internet reachability, and monitor authentication, upload, configuration, and administrative activity. Treat these mitigations as temporary risk reduction, not a substitute for the fixed release.
Upgrade and containment checklist
The research material does not provide a vendor-supported universal shell command for upgrading every Ivanti Connect Secure deployment. Do not use an unverified package-install command on a production appliance. Obtain the platform-specific update through Ivanti’s supported portal and apply it using the documented administrative workflow.
1. Record the current Ivanti Connect Secure build.
2. Obtain the vendor package for 25.1.1.3 or 22.8R2.6.
3. Validate the package through Ivanti's documented process.
4. Apply the update through the supported appliance workflow.
5. Confirm the post-upgrade build.
6. Recheck exposure, authentication, administrative activity, and logs.
If the appliance cannot be patched immediately, place it behind tightly controlled access where feasible and restrict administrative interfaces to approved management networks. Preserve relevant logs before making disruptive changes, because containment actions can remove useful evidence.
For broader incident-response context, review guidance on memory forensics when a potentially compromised appliance or connected system requires evidence preservation.
How This Vulnerability Works
CVE-2026-118527 is caused by the use of predictable filenames or identifiers when Ivanti Connect Secure handles uploaded files. A remote attacker with valid low-level authentication can provide attacker-controlled content and exploit the predictable naming behavior to place that content at a known location on the appliance filesystem.
The direct technical impact is an integrity violation: an attacker can introduce content into a location that should not be attacker-controlled. The NVD description does not assign direct confidentiality or availability impact, and the CVSS vector reflects that assessment. The flaw is therefore not described as a standalone unauthenticated remote-code-execution vulnerability.
The practical risk is higher than the base score suggests because the vulnerability can be chained. Reporting from CISA and Rapid7 describes exploitation alongside CVE-2026-104935, an authentication-bypass vulnerability, and CVE-2026-111357, a missing-authentication vulnerability associated with privilege escalation. In that attack-chain context, an attacker may progress from access to more privileged compromise of the appliance.
Root-cause implications
Predictable names reduce the uncertainty an application normally relies on when creating temporary or uploaded files. If an attacker can predict the destination and influence the content, the application may write attacker-controlled data into a location with security significance.
Do not assume that a low CVSS score means the upload was harmless. Review whether uploaded files appeared in expected temporary or upload directories, whether files were created or modified outside normal administrative activity, and whether suspicious changes occurred after authentication events associated with the appliance.
Severity, Explained
CVE-2026-118527 has a CVSS score of 4.3 Medium with the vector:
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
The score indicates that the vulnerability is reachable over the network (AV:N), exploitation is not considered unusually difficult (AC:L), and low privileges are required (PR:L). No user interaction is needed (UI:N), and the impact remains within the vulnerable product’s security authority (S:U).
The impact metrics are limited: no direct confidentiality impact (C:N), low integrity impact (I:L), and no direct availability impact (A:N). Those factors explain the medium rating. CVSS is a severity measure for the described vulnerability, however, and does not fully capture exploitation status, appliance exposure, attack chaining, or the consequences of compromising a remote-access gateway.
For prioritization, confirmed exploitation and the CISA KEV listing should outweigh the medium base score. Treat exposed, affected appliances as urgent remediation targets, especially when it cannot be established that an appliance was isolated from attacker access.
Is It Being Exploited?
Yes. Exploitation is confirmed in the wild. CISA added CVE-2026-118527 to its Known Exploited Vulnerabilities catalog on 2026-10-30, with a remediation due date of 2026-11-13 for applicable federal civilian agency systems. CISA also described exploitation of this vulnerability with related Ivanti Connect Secure vulnerabilities.
The available research identifies exploitation in attack chains involving CVE-2026-104935 and CVE-2026-111357. Rapid7 reported that the related Ivanti Connect Secure vulnerabilities were exploited as zero-days. Known ransomware campaign use is listed as unknown. That does not weaken the exploitation finding, because CISA’s KEV designation independently confirms that attackers have used the vulnerability.
No verified public GitHub proof-of-concept repository was identified in the supplied research. The appropriate status is confirmed exploitation in the wild, with no verified public GitHub PoC identified in the available sources. A public PoC is not required for urgent action; defenders should not wait for one before patching or investigating.
Detecting It in Your Environment
Start with asset discovery and version validation. Identify all Ivanti Connect Secure appliances, record their builds, and determine whether each one was internet-accessible or reachable from untrusted networks. Any appliance running 25.1.1.2 or earlier or 22.8R2.5 or earlier should be considered vulnerable until upgraded.
For potentially exposed appliances, review authentication and administrative records for unusual successful logins, activity from unexpected source addresses, access at unusual times, and privilege changes. Correlate those events with file-upload activity, unexpected files, configuration changes, and indicators associated with the related Ivanti vulnerability chain.
The supplied research does not provide a vendor-validated forensic artifact, canonical URI, or complete network signature for CVE-2026-118527. Do not invent a single path or request pattern and treat it as definitive. Use appliance-specific logs and file-integrity evidence instead, and compare activity with known maintenance windows.
Detection queries and log patterns
The following generic queries are starting points. Field names and paths must be adapted to the logging format available in the deployment:
index=network OR index=auth OR index=appliance
(
product="Ivanti Connect Secure"
OR vendor="Ivanti"
)
| search action IN ("success", "allowed", "login", "upload", "file_write")
| stats count values(action) as actions values(uri) as uris
values(file_path) as file_paths
by src_ip user dest_ip
| where count > 0
For a SIEM that stores normalized authentication events:
SELECT timestamp, src_ip, username, action, result, destination, user_agent
FROM appliance_events
WHERE product = 'Ivanti Connect Secure'
AND timestamp >= CURRENT_TIMESTAMP - INTERVAL '30' DAY
AND (
action IN ('login_success', 'upload', 'file_write',
'configuration_change', 'admin_action')
OR result = 'success'
)
ORDER BY timestamp ASC;
Investigate patterns such as:
successful low-privilege login
-> unexpected upload or file-write event
-> file creation in an upload or temporary location
-> administrative or configuration activity
Also compare filesystem inventories before and after patching. Unexpected files in appliance upload or temporary directories, unexplained configuration changes, and administrative actions that cannot be tied to authorized personnel should be escalated for forensic analysis. Preserve logs and system evidence before resetting credentials or rebuilding the appliance.
If compromised credentials may have been used elsewhere, review your organization’s MFA versus 2FA guidance while investigating authentication controls and account exposure.
References and Further Reading
The NVD record provides the vulnerability description, CVSS information, affected product context, and references:
Ivanti’s security advisory provides vendor affected-version and fixed-version information, along with upgrade guidance:
CISA’s KEV catalog confirms the exploitation status and records the remediation deadline:
CISA’s alert discusses related Ivanti Connect Secure exploitation activity and the requirement to apply vendor mitigations and conduct appropriate triage:
Rapid7’s reporting provides additional context on exploitation of the related Ivanti Connect Secure zero-days:
Treat CVE-2026-118527 as an incident-priority vulnerability for affected Ivanti Connect Secure appliances. Upgrade to 25.1.1.3 or 22.8R2.6, meet the applicable 2026-11-13 KEV deadline, restrict exposure where possible, and investigate for compromise rather than treating the update as routine patch maintenance.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.