Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

43
Patch now
MEDIUM 4.3EXPLOITEDMITIGATE

CVE-2026-118527 is a medium-severity flaw (CVSS 4.3) affecting Connect Secure, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.

Why this priority

  • Exploited in the wild (CISA KEV)
  • Covered by 8 security sources

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score4.3 (Medium)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededLow
User interactionNone
EPSS exploit chancen/a
CISA exploited listYes, fix due 2026-11-13
WeaknessCWE-340
Published2026-11-03
Last modified2026-11-03
Publisher (CNA): ivanti · Vendor: Ivanti

Share: LinkedIn · X · Reddit

Last updated 2026-11-03 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Timeline

Ivanti Connect Secure MITIGATE
Affected: See advisory
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Advisories and coverage

Official advisories

Research and news

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-118527?

Connect Secure: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2026-118527 being exploited?

Yes. CVE-2026-118527 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2026-118527 affect?

CVE-2026-118527 affects Connect Secure. Severity is medium (CVSS 4.3). Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.

How urgent is CVE-2026-118527?

Priority 43/100. Exploited in the wild (CISA KEV); Covered by 8 security sources

Software pages

Ivanti vulnerabilities

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.