UpHeron
All vulnerabilities

Servers and applications

CVE-2026-118527

Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 30 Oct 2026.

Severity
Medium 4.3
Published
3 Nov 2026
Last changed
3 Nov 2026
Added to UpHeron
3 Nov 2026
Fixed in
25.1.1.3
Sources
NVD, CVE Program

Affected software

SoftwareAffected versions
Ivanti Connect SecureServers and applications · cna:ivanti|connect secureNot stated by the source
Ivanti Connect SecureServers and applications · cpe:a:ivanti:connect_secure
  • From 25.1.0.0 before 25.1.1.3
  • Version 22.8-r2.5
  • Version 22.8-r2.4
  • Version 22.8-r2.3
All 7 release lines
  • Version 22.8-r2
  • Version 22.8-r2.1
  • Version 22.8-r2.2
  • Version 22.8-r2.3
  • Version 22.8-r2.4
  • Version 22.8-r2.5
  • From 25.1.0.0 before 25.1.1.3

Known exploited

CISA name
Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or…
Due for US agencies
13 Nov 2026
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-118527
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-118527