CVE-2026-118527

Think of this like an office building where staff badges let employees drop off packages in a particular mail slot — but the slot's location is easy to guess. Someone with a valid badge (a logged-in account) can use that predictability to slip in a harmful package that lands exactly where it can cause trouble later. Ivanti Connect Secure is widely used as a remote-access VPN gateway, so a planted file here can give an attacker a lasting foothold into your network.

This matters to you if your organization uses Ivanti Connect Secure for remote access or VPN connectivity. The attacker needs a valid login to your Connect Secure system, so this is most dangerous if attacker-obtained or weak credentials exist, or if any account on the system has already been compromised.

Attackers are already exploiting this flaw in real-world attacks, and CISA has ordered federal agencies to fix it by November 13, 2026. This is not a theoretical risk — treat it as urgent and patch without delay.

1. Inventory all Ivanti Connect Secure instances and record exact version numbers.
2. Confirm exposure: any instance below 25.1.1.3 (25.x branch) or 22.8R2.6 (22.x branch) is vulnerable to CWE-340 predictable filename file upload by an authenticated user.
3. Upgrade to the fixed version matching your branch — 25.1.1.3 or 22.8R2.6 — following Ivanti's advisory for upgrade sequencing and any breaking-change notes.
4. If immediate patching isn't possible, restrict authenticated access to trusted users, enforce MFA, and monitor file-system write activity to known upload directories as an interim mitigation.
5. Per CISA KEV, this is confirmed exploited in the wild; federal agencies face a November 13, 2026 remediation deadline under BOD 26-04 — apply equivalent urgency regardless of sector.
6. Conduct forensic triage per CISA's guidance referenced in the advisory to check for prior compromise before/after patching.
7. Monitor for unusual file creation, unexpected account activity, and persistence mechanisms on Connect Secure appliances going forward.

CVSS 4.3 (Medium, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) reflects limited direct impact (integrity-only, no confidentiality/availability loss) but the real risk is higher given confirmed active exploitation — this is listed in CISA KEV (added 2026-10-30, due 2026-11-13). No public exploit code has been published yet, but in-the-wild use is already confirmed, so exploit maturity should be considered functional/active rather than theoretical. Weakness is CWE-340 (Generation of Predictable Numbers or Identifiers), enabling an authenticated attacker to upload attacker-controlled content to a predictable filesystem path, likely as a staging step for further compromise (e.g., webshell placement or persistence). Fixed in 25.1.1.3 and 22.8R2.6.