Ivanti Connect Secure zero-days chained for unauthenticated root
Fixes are 25.1.1.3 and 22.8R2.6 after UTA0576 hit a fully patched 22.8R2.4 appliance.
88
CVE-2026-118527
Predictable identifiers in Ivanti Connect Secure enable file upload
CISA: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
- CVSS
- —
- EPSS
- —
- Published
- —
- Added to KEV
AI analysisSummaries by Vani AI
Ivanti Connect Secure uses predictable numbers or identifiers so a remote authenticated attacker can upload attacker-controlled files to a known path on disk. The issue can be chained with CVE-2026-104935 and CVE-2026-111357. It is being exploited in the wild. Affected product versions are not listed.
What to do: Apply Ivanti's mitigations for CVE-2026-118527 per vendor instructions and CISA BOD 26-04. If mitigations are unavailable, discontinue use of the product.
| Product | Affected |
|---|---|
| Ivanti Connect Secure | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.
KEVCISA Known Exploited Vulnerability
- Affected
- Ivanti Connect Secure
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
In the news
4 storiesIvanti Connect Secure zero-days exploited for root access and credential theft
Volexity links the October chain to UTA0576; Ivanti says few customers were hit and fixed builds are 25.1.1.3 and 22.8R2.6.
86
CISA adds two exploited Ivanti Connect Secure flaws to KEV
CVE-2026-111357 and CVE-2026-118527 were added after evidence of active exploitation; FCEB agencies must prioritize them under BOD 26-04.
76
CISA KEV lists Ivanti Connect Secure flaw CVE-2026-118527
An authenticated remote attacker can upload chosen files to a known path; the federal due date is November 13.
74