Ivanti Connect Secure: Predictable Identifier Vulnerability CVE-2026-118527

Catalog analysis: CISA added this entry on October 30, 2026. The entry reflects catalog information retrieved on October 30, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-118527 is a vulnerability in Ivanti Connect Secure involving the generation of predictable numbers or identifiers (CWE-340). This flaw allows a remote authenticated attacker to upload files containing attacker-controlled content to a known location on the disk.

Of particular concern for vulnerability management teams is the potential for exploit chaining. The source indicates that this vulnerability can be combined with CVE-2026-104935 and CVE-2026-111357, which may increase the overall impact of a compromise.

Exposure and applicability

This vulnerability affects Ivanti Connect Secure deployments. The primary exposure path requires the attacker to be authenticated; however, the predictability of identifiers allows for targeted file placement on the system disk.

Infrastructure owners should prioritize assets with direct internet exposure, as these represent the highest risk for initial access and subsequent chaining attempts. Organizations utilizing cloud-based versions of this service must also evaluate their specific deployment against vendor guidance.

Remediation priorities

Based on our analysis, remediation should be prioritized according to the following hierarchy:

1. Immediate Mitigation Application: Apply all mitigations as specified in the vendor’s instructions. Because this flaw can be chained with other CVEs, treating it as an isolated issue may leave the system exposed to more complex attack vectors.
2. Forensic Triage: In accordance with CISA’s Forensics Triage Requirements, defenders should examine systems for evidence of unauthorized file uploads to known disk locations before assuming a mitigation has neutralized existing threats.
3. Exposure Reduction: Evaluate and restrict internet-facing exposure of the affected assets to reduce the surface area available to authenticated attackers.

How to validate remediation

Verifying that a vulnerability is addressed requires moving beyond version checks or the mere application of a patch. To assure that exposure has been reduced, defenders should:

• Verify Mitigation State: Confirm through vendor-provided tools or configuration audits that the specific mitigations for CVE-2026-118527 are active.
• Audit File System Integrity: Check known disk locations for unauthorized files that may have been uploaded prior to mitigation.
• Chain Analysis: Ensure that mitigations for the related vulnerabilities (CVE-2026-104935 and CVE-2026-111357) are also verified, as the risk remains elevated if any link in the potential chain is left open.

Limits and open questions

The current source does not specify whether a permanent software patch has been released or if only temporary mitigations are available. Furthermore, while the vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, the status of its use in known ransomware campaigns remains unknown.

Residual risk persists because applying a mitigation may prevent new uploads but does not automatically remove files already placed on the disk by an attacker. Additionally, the full extent of the impact when chained with CVE-2026-104935 and CVE-2026-111357 is not detailed in the provided data.

Source and editorial note

CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability · Source date: October 30, 2026 · Retrieved October 30, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment