Ivanti Connect Secure Predictable Identifier File Upload
CISA lists an exploited predictable-identifier flaw in Ivanti Connect Secure. A remote authenticated attacker can upload attacker-controlled files to a known location on disk.
- Vendor
- Ivanti
- Product
- Connect Secure
- CVSS
- N/A
- EPSS (exploit probability)
- N/A
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-118527 being exploited?
Yes. CISA added CVE-2026-118527 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-02. Full cross-catalog view: /kev-comparison
CVE-2026-118527 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (14 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CISA’s Known Exploited Vulnerabilities catalog lists CVE-2026-118527 as a predictable-identifier vulnerability in Ivanti Connect Secure. CISA says a remote authenticated attacker can upload files with attacker-controlled content to a known location on disk. The catalog says this flaw can be chained with CVE-2026-104935 and CVE-2026-111357.
CISA added the entry on October 30, 2026, indicating known exploitation, and set November 13 as the federal remediation due date. Its required action is to apply vendor mitigations under BOD 26-04 and follow the linked forensic triage guidance. The catalog marks ransomware campaign use as unknown.
No CVSS score is supplied by CISA for this entry. The severity badge remains unknown; a KEV listing confirms exploitation but does not supply a severity rating. Check Ivanti’s advisory linked from CISA’s entry for current update instructions, and see our coverage of the full Connect Secure chain.
Other Ivanti Connect Secure CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability | [ HIGH ] | 7.0 | 0.5% | |
| CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofingwrite-up | [ HIGH ] | 8.6 | 86.8% | |
| CVE-2025-22457 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerabilityransomware use | [ CRITICAL ] | 9.0 | 100.0% | |
| CVE-2025-0282 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerabilityransomware use | [ CRITICAL ] | 9.0 | 100.0% | |
| CVE-2024-21893 Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerabilityransomware use | [ HIGH ] | 8.2 | 100.0% | |
| CVE-2024-21887 Ivanti Connect Secure / Policy Secure Command Injectionransomware usewrite-up | [ CRITICAL ] | 9.1 | 100.0% | |
| CVE-2023-46805 Ivanti Connect Secure / Policy Secure Authentication Bypassransomware usewrite-up | [ HIGH ] | 8.2 | 100.0% | |
| CVE-2021-22900 Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability | [ HIGH ] | 7.2 | 14.1% |
