CVE-2026-118527: Ivanti Connect Secure Identifier Generation Flaw

# CVE-2026-118527: Ivanti Connect Secure Identifier Generation Flaw

https://gcdradar.vercel.app/incidents/cve-2026-118527-ivanti-connect-secure-identifier-generation · AIR-2026-1678 · live

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Confirmed exploitation in the wild via CISA KEV.
- Fix status: Patched
- First reported: 2026-10-30
- AI role: No AI role
- Products: Ivanti Connect Secure
- CVE ids: CVE-2026-118527
- CVSS: 4.3

## Summary

Ivanti Connect Secure contains a predictable identifier vulnerability that enables remote authenticated users to upload arbitrary files to disk. CISA added the issue to its Known Exploited Vulnerabilities catalog.

## What to do

Update Ivanti Connect Secure to 25.1.1.3 or 22.8R2.6.

## Affected and fixed versions

- Affected: Ivanti Connect Secure 25.1.1.2 and prior
- Affected: Ivanti Connect Secure 22.8R2.5 and prior
- Fixed in: Ivanti Connect Secure 25.1.1.3
- Fixed in: Ivanti Connect Secure 22.8R2.6

## Latest updates

- 2026-11-02: Ivanti releases fixes in Connect Secure 25.1.1.3 and 22.8R2.6 (https://securityweek.com/ivanti-patches-two-more-zero-days-exploited-in-connect-secure-attack-chain)
- 2026-10-30: CVE-2026-118527: Ivanti Connect Secure — Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-118527)

## Sources

- 2026-10-30 CISA: CVE-2026-118527: Ivanti Connect Secure — Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-118527
- 2026-11-02 SecurityWeek: Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain https://securityweek.com/ivanti-patches-two-more-zero-days-exploited-in-connect-secure-attack-chain
- 2026-11-02 Help Net Security: CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) https://helpnetsecurity.com/2026/11/02/cisa-to-federal-agencies-remediate-exploited-ivanti-connect-secure-vulnerabilities-cve-2026-111357-cve-2026-118527
- 2026-11-02 BleepingComputer: Ivanti patches two more Connect Secure zero-days chained in attacks https://bleepingcomputer.com/news/security/ivanti-patches-two-more-connect-secure-zero-days-chained-in-attacks

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.