CVE-2026-118527 Exploited in the wild

Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

Risk score: 88/100
CVSS: Not Scored
Added to CISA's exploited list: 30 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Ivanti Connect Secure has a vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This can be chained with other vulnerabilities.
Affected: {'product': 'Connect Secure', 'vendor': 'Ivanti'}
Fix: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 guidance
Exploitation: Exploited in the wild

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Ivanti Connect Secure: Red, act today. Ivanti Connect Secure has a vulnerability (CVE-2026-104935) that allows a remote attacker to execute arbitrary commands without authentication. This could lead to a high impact on confidentiality, integrity, and availability.

The flaws

CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability (exploited)
CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability (CVSS 8.6 · EPSS 87% · exploited)
CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability (CVSS 7.0 · EPSS 0% · exploited)

The fix

Upgrade Ivanti Connect Secure: 25.1.3.0 or later on your release line

Who is exposed: {'products': ['Ivanti Connect Secure'], 'packages': [], 'versions': ['before 25.1.3.0']}

Where it stands

Exploited in the wild
On CISA's exploited list since 13 Oct
US federal deadline 16 Oct
2 outlets covering it

How it unfolded

13 Oct, CISA (official): Added to the Known Exploited Vulnerabilities list (3 of these flaws)
14 Oct, Dark Reading (press): Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles
16 Oct, Deadline (official): US federal agencies must have patched
28 Oct, BleepingComputer (press): InfraTrust report warns of exploited flaws in critical network infrastructure
30 Oct, CISA advisories (US) (official): CISA Adds Two Known Exploited Vulnerabilities to Catalog

Connects to

Same weakness: CWE-340 (CWE-340). 4 other warnings in 30 days
Reported alongside: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability. CVE-2026-94127 · in 1 of the same article
Reported alongside: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability. CVE-2026-93952 · in 1 of the same article

Why it is Red

Not yet scored by NVD
Exploited in the wild (CISA KEV)
On your watchlist: ivanti
Named in a government or vendor bulletin

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Government and vendor bulletins

CISA Adds Two Known Exploited Vulnerabilities to Catalog

Original description

Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.

Last activity 30 Oct 2026. Patch Forecast updates every hour.