CISA KEV lists Ivanti Connect Secure flaw CVE-2026-118527
Original title: CISA KEV: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability — Ivanti Connect Secure (CVE-2026-118527)
An authenticated remote attacker can upload chosen files to a known path; the federal due date is November 13.
CISA’s KEV entry for CVE-2026-118527 says Ivanti Connect Secure generates predictable numbers or identifiers, allowing a remote authenticated attacker to upload attacker-controlled files to a known location on disk. The entry says it can be chained with CVE-2026-104935 and CVE-2026-111357. Required action is vendor mitigations plus BOD 26-04 and forensics triage, due November 13, 2026. Known ransomware campaign use is unknown.
Unconfirmed: Known ransomware campaign use is listed as unknown, and chaining in real attacks is not confirmed.
- Due date is November 13, 2026.
- It can be chained with CVE-2026-104935 and CVE-2026-111357.
- Known ransomware campaign use is unknown.
- Discontinue the product if mitigations are unavailable.
Impact: Authenticated remote upload of attacker-controlled files to a known path.
| Product | Affected |
|---|---|
| Ivanti Connect Secure | — |
- 1.Apply mitigations according to Ivanti’s instructions.
- 2.Follow BOD 26-04 and CISA forensics triage requirements.
- 3.Discontinue use if mitigations are unavailable.
- CVEs
- CVE-2026-118527
- Vendors
- Ivanti
- Products
- Ivanti Connect Secure
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-118527 | Predictable identifiers in Ivanti Connect Secure enable file upload | — | — | KEV | — KEV |
From the original article
1 min read at cisa.govIvanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.
cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.