CVE-2026-118527 - PatchNow

← Back to Overview

HIGH_RISK

Risk Level

4.3

CVSS Score

NETWORK

Attack Vector

Initial Access

ATT&CK Tactic

T1190 — Exploit Public-Facing Application

ATT&CK Technique

VERY_HIGH

Deployment Risk

Ransomware

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-11-03

Added to CISA KEV: 2026-10-30 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — PATCH IMMEDIATELY: This CVE is listed in the CISA KEV catalog with confirmed active exploitation. Apply Ivanti Connect Secure updates to version 25.1.1.3 or 22.8R2.6 as an emergency priority. Do not delay patching pending change-window scheduling.
CRITICAL — HUNT FOR COMPROMISE: Before and after patching, perform a thorough compromise assessment. Ivanti has published Integrity Checker Tool (ICT) guidance; run the ICT against all appliances. Review VPN authentication logs for anomalous low-privilege accounts, unexpected file creation events, and unusual tunnel activity. Assume breach posture if the appliance was unpatched and internet-exposed.
CRITICAL — CHECK FOR CHAINED EXPLOITATION: Because this CVE is observed chained with other Ivanti flaws for root access, also audit for indicators of compromise associated with the companion CVEs referenced in threat intelligence (check CISA advisory and Ivanti security bulletin for companion CVE IDs). A single patch for CVE-2026-118527 alone may be insufficient if other flaws in the chain are unpatched.
HIGH — RESTRICT ACCESS PENDING PATCH: If immediate patching is not possible, restrict internet access to the VPN portal to known IP ranges or implement a WAF/reverse proxy with anomaly detection. Disable or tightly control low-privilege accounts that could be used as the authentication prerequisite.
HIGH — AUDIT DISK LOCATIONS: Investigate whether any unexpected files have been written to the appliance filesystem at locations consistent with the predictable filename pattern. Consult Ivanti's advisory for specific paths to audit.
MEDIUM — MONITOR AUTHENTICATION LOGS: Enable enhanced logging on the Ivanti appliance and ship logs to SIEM. Alert on: authentication events from unexpected geographies, repeated authentication attempts from a single IP, and any access from service or generic accounts.
MEDIUM — REVIEW VENDOR ADVISORY: Consult the official Ivanti security advisory (https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935) for vendor-specific indicators of compromise, workarounds, and configuration hardening guidance.
PATCH PRIORITY: EMERGENCY — treat as P0. CISA KEV + active chaining exploitation + internet-facing VPN appliance = maximum urgency regardless of base CVSS score of 4.3.

🔍 Web Intelligence (Kagi · 2026-11-03)

Summary

CVE-2026-118527 is a critical vulnerability affecting Ivanti Connect Secure that stems from the generation of predictable numbers or identifiers (CWE-340). This flaw allows remote attackers to bypass security measures by predicting file identifiers, ultimately facilitating unauthorized file uploads to known locations on the appliance's disk. Because it is being actively used in chained attack scenarios to compromise enterprise networks, it represents a significant security risk for organizations relying on these VPN appliances.

Exploitation

Active Exploitation: The vulnerability has been confirmed as exploited in the wild and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 30, 2026 ^[4]^[6].
Attack Chains: Threat actors have been observed chaining this vulnerability with other flaws in Ivanti Connect Secure to achieve elevated access, including unauthenticated root access in some instances ^[2]^[5].
Tooling: While specific public proof-of-concept code may vary, the inclusion in CISA’s KEV catalog indicates that weaponized exploit tools are currently in use by malicious actors ^[1].
Prerequisites: The vulnerability is remotely exploitable. While some reports suggest it can be leveraged as part of an unauthenticated attack chain, it is generally characterized as allowing remote attackers to perform unauthorized actions ^[2]^[3].

Affected Products & Patches

Affected Products: The vulnerability affects Ivanti Connect Secure appliances ^[7].
Patches: Security patches are available from the vendor; users are urged to review official Ivanti security advisories and update to the latest version immediately ^[3]^[4].
Mitigation: Organizations that cannot patch immediately should follow guidance provided by CISA and Ivanti regarding the restriction of network access and the monitoring of VPN appliance logs for anomalous behavior.

Impact

Access Capability: Successful exploitation allows remote attackers to upload arbitrary files with attacker-controlled content to specific locations on the system disk, which is a critical step toward achieving remote code execution or persistence ^[2].
Business Risk: For internet-facing deployments, this vulnerability provides an entry point for attackers to gain deeper network access, potentially leading to full system compromise, data exfiltration, and significant operational disruption ^[1].

Sources

CVE-2026-118527: Ivanti Input Validation — Exploited
CVE-2026-118527 impacts Ivanti Connect Secure with a CVSS v3.1 base score of 7.5 (CRITICAL), exposing enterprise deployments to critical operational disruption. CISA confirmed active weaponization in the wild, placing CVE-2026-118527 into the Known Exploited Vulnerabilities (KEV) catalog with mandat…
Attackers Chain Three Ivanti Connect Secure Flaws to Gain ...
CVE-2026-118527 (CVSS score: 4.3) - A generation of predictable numbers or identifiers vulnerability that could allow a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
CVE-2026-118527 · Ivanti · CVSS 9.5 · CISA KEV · CVE Brief Analyst Report
CVE-2026-118527 9.5 CISA KEV Ivanti · Connect Secure Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows remote attackers to perform unauthorized file uploads. Quick facts CVSS score 9.5 (Critical) CISA KEV Listed (confirmed active exploitation…
CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect ...
CISA added CVE-2026-104935 to its KEV Catalog on Oct. 13, 2026, and CVE-2026-111357 and CVE-2026-118527 on Oct. 30, 2026. CISA urges organizations with affected Ivanti Connect Secure appliances and deployments to immediately update to the latest version, as outlined in Ivanti’s Security Advisory Iva…
CVE-2026-118527 - Exploits & Severity - Feedly
A predictable-filename weakness in Ivanti Connect Secure allowed attackers to exploit the appliance for unauthenticated root access as part of an automated exploit chain.

🔴 CVE-2026-118527