Ivanti Connect Secure CVE-2026-118527 Exploited: What to Do

On this page (7 sections)

CVE-2026-118527 is a vulnerability in Ivanti Connect Secure that CISA added to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-30, which means it is being exploited in the wild. Per the NVD entry, a remote authenticated attacker can upload files with attacker-controlled content to a known location on disk.

Anyone who runs Ivanti Connect Secure, or is responsible for a network that does, should treat this as a priority. Public detail is thin so far, and this article separates what is confirmed from what is not.

What is known so far

The only technical description comes from NVD. It says Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability. A remote attacker who is already authenticated can use it to upload files with content they control to a location on disk that they can know in advance.

The same description states that this vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357. Chaining means an attacker combines several flaws to reach a result that one flaw alone would not allow. The sources we have say nothing further about those two CVEs, so we do not describe them here.

What is not known yet

Several details are missing, and we will not guess at them:

No CVSS score or official severity has been published in the sources. The NVD page carries only a short description, with no full record, score or publication date in the research.
The sources do not list affected versions or fixed versions, and we have not seen a vendor advisory in the research.
It is not stated who is exploiting the flaw, how widely, or what they do after uploading a file.
CISA lists known ransomware campaign use as Unknown.
Only one independent publisher covers this story so far, so details may change quickly.

Do not assume a particular version is safe or vulnerable until Ivanti's own advisory says so. Check Ivanti's security advisory page for CVE-2026-118527 and the related CVEs.

Why predictable identifiers matter

When software creates file names, paths or tokens in a way an outsider can predict, an attacker does not need to discover where an uploaded file ended up. Here the NVD text says the upload lands in a known location on disk. An attacker-controlled file in a known place is a useful stepping stone, especially in a chain with other flaws, because a later step can then refer to that file directly.

The attacker must be authenticated, which lowers the immediate risk compared with an unauthenticated bug. It does not remove it. Stolen or reused VPN credentials are common, and the chaining note suggests the flaw is valuable as one link among several.

Who is exposed

Any organization running Ivanti Connect Secure is potentially in scope until the vendor says otherwise. Connect Secure is an internet-facing remote access gateway, so exposure is usually easy for outsiders to see. Agencies and hosting administrators who manage appliances for clients should include those in their review.

Because CISA lists it in KEV with a due date of 2026-11-13, US federal agencies are required to act by then. The KEV required action says to apply mitigations in accordance with vendor instructions, and to discontinue use of the product if mitigations are unavailable. Private organizations are not bound by this, but it is a sensible deadline to borrow.

What to do now

Find every Ivanti Connect Secure appliance you run, including test, backup and client-managed units.
Read Ivanti's advisory for CVE-2026-118527, CVE-2026-104935 and CVE-2026-111357 and apply the mitigations or updates it lists.
Aim to finish by 2026-11-13, the CISA due date.
Review accounts: remove unused users, force password resets where compromise is possible, and require multi-factor authentication.
Restrict the management interface so it is not reachable from the open internet.
Review appliance logs for unusual authentication and file activity since before 2026-10-30.
If you find signs of compromise, follow your incident response plan and use Ivanti's guidance for integrity checks before trusting the appliance again.
If no mitigation is available for your deployment, consider taking the appliance out of service, as CISA's required action describes.

Caution. Applying updates or mitigations to a VPN gateway can interrupt remote access. Schedule a maintenance window and keep a way to reach the appliance's console in case something goes wrong.

Tip. Keep a record of the appliance's current version, configuration backup and admin accounts before you change anything. It helps both rollback and any later investigation.

Detection and monitoring

Public indicators of compromise for this CVE are not in our sources, so rely on the vendor's guidance for specific signs. In general, watch for successful logins from unfamiliar locations, logins at odd hours, new or changed admin accounts, and unexpected configuration changes. Forward the appliance logs to a central system so that records survive if the device itself is tampered with.

From the outside, you can check that your gateway's TLS certificate is valid and has not changed unexpectedly with the free SSL checker, and Webforta Monitor can watch certificates, DNS and uptime for changes. These checks do not tell you whether the appliance is vulnerable or compromised, so they supplement vendor guidance and do not replace it.

Timeline

Dates from the available sources
Date	Event
2026-10-30	CVE-2026-118527 added to CISA's KEV catalog
2026-11-13	CISA remediation due date for the KEV entry

At the time of writing, the sources give no CVSS score, affected versions or fixed versions, and the NVD page shows only a short description without a full record or publication date. We will revise this article if Ivanti or NVD publish version details or a severity score.

Sources

This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.

Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability (CVE-2026-118527) is being actively exploitednvd.nist.gov · 30 October 2026

Frequently asked questions

Is CVE-2026-118527 being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-30, which indicates exploitation in the wild. The sources do not say who is exploiting it or how widely.

Does the attacker need to log in first?

According to the NVD description, the attacker must be remote and authenticated. Stolen or weak credentials could still give an attacker that access, so account hygiene and multi-factor authentication matter.

Which Ivanti Connect Secure versions are affected and which are fixed?

The sources we have do not state affected or fixed versions. Check Ivanti's official advisory for CVE-2026-118527 before deciding which version to run.

What is the CISA deadline for this vulnerability?

CISA set a due date of 2026-11-13. This binds US federal agencies, but other organizations can use it as a target.

What does it mean that this flaw can be chained with other CVEs?

NVD says it can be chained with CVE-2026-104935 and CVE-2026-111357. An attacker may combine the flaws so that together they achieve more than any one alone, so review all three together.

Keep reading