CISA has added CVE-2026-118527, a predictable-identifier flaw in Ivanti Connect Secure, to its Known Exploited Vulnerabilities (KEV) catalog, which confirms it is being exploited in the wild.
What Is It
CVE-2026-118527 is a "generation of predictable numbers or identifiers" vulnerability (CWE-340) in Ivanti Connect Secure. According to CISA, it allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
The flaw does more harm when combined with others. CISA notes it can be chained with CVE-2026-104935 and CVE-2026-111357.
Why It Matters
CISA added the CVE to the KEV catalog on 2026-10-30. KEV listing means CISA has evidence of active exploitation. When an attacker can write content they control to a predictable path on the device, that often becomes a building block in a larger attack chain. CISA's note that it can be chained with two other CVEs points the same way.
CISA lists known ransomware campaign use as "Unknown." The NVD record has no description, CVSS score, or severity yet, so there is no official severity rating to cite.
What's Vulnerable
- Vendor: Ivanti
- Product: Connect Secure
The supplied KEV and NVD data do not list affected versions or CPEs. Check the Ivanti security advisory to see which builds are affected.
Patch Status
CISA's required action is to apply mitigations according to vendor instructions, in line with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's "Forensics Triage Requirements." If mitigations are not available, organizations should follow the BOD 26-04 guidance for cloud services or stop using the product. Stakeholders are responsible for assessing each asset's internet exposure and following BOD 26-04 patching guidelines.
- Federal remediation due date: 2026-11-13
- KEV forensic triage flag: No
The KEV entry links to the Ivanti advisory for CVE-2026-104935, one of the CVEs in the chain. Use that advisory for vendor fix and mitigation details. Defenders running Connect Secure should also review their exposure to CVE-2026-104935 and CVE-2026-111357.