The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
This vulnerability is being actively exploited in the wild, according to the CISA Known Exploited Vulnerabilities catalog. CISA added it on .
CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
- Identifier
- CVE-2026-118527
- Published
- Record updated
- Fixed in
- The source references a patch, a mitigation or a vendor advisory.
Summary
CVE-2026-118527 is a generation of predictable numbers or identifiers vulnerability in Ivanti Connect Secure. A remote authenticated attacker can upload files with attacker-controlled content to a known location on disk. It can be chained with CVE-2026-104935 and CVE-2026-111357. The item is listed as actively exploited in the wild (CISA KEV).
Mitigation
Apply mitigations in accordance with vendor instructions, in line with CISA's BOD 26-04 guidance and the CISA Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders should evaluate each asset's internet exposure and adhere to BOD 26-04 patching guidelines. Due date: 2026-11-13.