Executive Summary
CVE-2026-118527 is a generation-of-predictable-numbers-or-identifiers flaw in Ivanti Connect Secure. A remote, authenticated attacker can upload files with attacker-controlled content to a known location on disk. On its own it is low-scored (CVSS 4.3), but Ivanti says it is being exploited in a chain with two other Connect Secure flaws, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on October 30, 2026.
We rate it high because of confirmed in-the-wild exploitation as part of the chain, not because of its standalone score.
Vulnerability Details
| Field | Details |
|---|---|
| CVE | CVE-2026-118527 |
| Product | Ivanti Connect Secure |
| Type | Predictable identifier / filename leading to arbitrary-content file upload |
| Authentication | Required (low-privilege authenticated user) |
| CVSS | 4.3 (standalone) |
| CISA KEV | Added October 30, 2026 |
| Fixed versions | 25.1.1.3 and 22.8R2.6 |
The Exploit Chain
Ivanti's October 29 advisory update says it is aware of exploitation against a limited number of customers when these CVEs are chained:
| CVE | Role | Notes |
|---|---|---|
| CVE-2026-104935 | Authentication bypass leading to remote command execution | CVSS 8.6; KEV since October 13; commands can run in memory, so Ivanti's Integrity Checker Tool may not detect exploitation |
| CVE-2026-111357 | Missing authentication / privilege escalation | CVSS 8.8; added to KEV October 30 |
| CVE-2026-118527 | Predictable identifier, file write to a known path | CVSS 4.3; added to KEV October 30 |
Because the file location is predictable, an attacker who can authenticate (for example via the bypass) can place content where later chain stages expect it.
Affected Systems
| Branch | Vulnerable | Fixed |
|---|---|---|
| 25.1.x | 25.1.1.2 and earlier | 25.1.1.3 |
| 22.8R2.x | 22.8R2.5 and earlier | 22.8R2.6 |
Remediation
- Upgrade to 25.1.1.3 or 22.8R2.6 (or later) immediately. Patches cover all three chained CVEs.
- Do not rely on the Integrity Checker Tool alone. In-memory execution may evade it, so treat appliances that were exposed and unpatched since mid-October as potentially compromised.
- Hunt for compromise: review admin and VPN authentication logs for anomalous logins, unexpected files in appliance upload directories, and unfamiliar outbound connections.
- Rotate credentials that traverse or are stored on the appliance, including service accounts, LDAP bind accounts, and certificates, if compromise is suspected.
- Restrict management interfaces to trusted networks.
Federal civilian agencies must remediate KEV entries by the deadline CISA sets; all organizations should treat this as urgent.
References
- NVD — CVE-2026-118527
- CISA — Adds Two Known Exploited Vulnerabilities to Catalog (Oct 30, 2026)
- CISA — Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure
- eSentire — Ivanti Connect Secure Zero-Day (CVE-2026-104935)