CVE-2026-118527
Description
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
Known exploited (CISA KEV)
- Name
- Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
- Date added
- 2026-10-30
- Due date
- 2026-11-13 (for US federal agencies)
- Ransomware use
- unknown
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Summary
- Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Ivanti | Connect Secure | not stated |
Affected configurations (NVD)
CPE applicability statements from the NVD's analysis: 1 configuration, 7 CPE matches. In a configuration marked “all of”, the vulnerable product is affected only together with the others listed (for example the hardware it runs on).
CPE matches
| # | CPE | Versions | Role |
|---|---|---|---|
| 1 | ivanti connect securecpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:* |
≥ 25.1.0.0, < 25.1.1.3 | vulnerable |
ivanti connect secure 22.8cpe:2.3:a:ivanti:connect_secure:22.8:r2:*:*:*:*:*:* |
as named | vulnerable | |
ivanti connect secure 22.8cpe:2.3:a:ivanti:connect_secure:22.8:r2.1:*:*:*:*:*:* |
as named | vulnerable | |
ivanti connect secure 22.8cpe:2.3:a:ivanti:connect_secure:22.8:r2.2:*:*:*:*:*:* |
as named | vulnerable | |
ivanti connect secure 22.8cpe:2.3:a:ivanti:connect_secure:22.8:r2.3:*:*:*:*:*:* |
as named | vulnerable | |
ivanti connect secure 22.8cpe:2.3:a:ivanti:connect_secure:22.8:r2.4:*:*:*:*:*:* |
as named | vulnerable | |
ivanti connect secure 22.8cpe:2.3:a:ivanti:connect_secure:22.8:r2.5:*:*:*:*:*:* |
as named | vulnerable |
References
External links from the record. They lead to third-party sites.