4.3
Moyenne
Exploitée
CVE-2026-118527 Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Campagnes de rançongiciel
Non constatée à ce jour
Faiblesse
CWE-340
Description
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Connect Secure 25.1 | premières → < 25.1.1.3 | 25.1.1.3 |
| Connect Secure 22.8 | premières → < 22.8R2.6 | 22.8R2.6 |
Références
- hub.ivanti.com hub.ivanti.com
Chronologie
- Publiée
- Ajoutée au catalogue KEV
- Dernière modification
Autres CVE de Connect Secure
Les 65 CVE de Connect Secure →
CVE-2026-111357
Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
7.0
Élevée
CVE-2026-104935
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
8.6
Élevée
CVE-2025-55144
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti…
5.4
Moyenne
CVE-2025-55143
Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6,…
6.1
Moyenne