4.3
Medium
Exploited
CVE-2026-118527 Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware campaigns
Not observed so far
Weakness
CWE-340
Description
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Connect Secure 25.1 | earliest → < 25.1.1.3 | 25.1.1.3 |
| Connect Secure 22.8 | earliest → < 22.8R2.6 | 22.8R2.6 |
References
- hub.ivanti.com hub.ivanti.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of Connect Secure
The 65 CVEs of Connect Secure →
CVE-2026-111357
Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
7.0
High
CVE-2026-104935
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
8.6
High
CVE-2025-55144
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti…
5.4
Medium
CVE-2025-55143
Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6,…
6.1
Medium