CVE-2026-118527

Published: Nov 3, 2026Modified: Nov 3, 2026CISA KEV

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75 (Secondary)

Description

Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.

Affected (7)

Products: Ivanti: Connect Secure

Ivanti

1 product

Connect Secure

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Ivanti Connect Secure	25.1.0.0 ≤ version < 25.1.1.3
Ivanti Connect Secure	Version 22.8 r2.1
Ivanti Connect Secure	Version 22.8 r2.2
Ivanti Connect Secure	Version 22.8 r2.3
Ivanti Connect Secure	Version 22.8 r2.4
Ivanti Connect Secure	Version 22.8 r2.5
Ivanti Connect Secure	Version 22.8 r2

Related CWEs

CWE-340

Generation of Predictable Numbers or Identifiers

The product uses a scheme that generates numbers or identifiers that are more predictable than required.

References (2)

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US

Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-118527

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.