NewsCompaniesFlawsGuides
Get the app

CVE-2026-118527

From Exploited flaws, HARD’s guide to the flaws being used in attacks · Checked
This article is about a flaw in Ivanti Connect Secure. For every flaw being used in attacks, see Exploited flaws; for Ivanti’s, see Ivanti flaws being used in attacks.

CVE-2026-118527 is a security flaw in Ivanti Connect Secure, a VPN companies use to let staff in from outside. Attackers are using a flaw in Ivanti Connect Secure. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its catalog of flaws known to be used in attacks on 30 Oct 2026.[1]

Ivanti Connect Secure is business software or equipment. Most families won’t have it, but attackers break into it to get inside companies, and from there to what those companies hold about their customers, patients and staff. Ivanti has published a fix or advice.

Description

CISA calls it a generation of predictable numbers or identifiers in Ivanti Connect Secure. In its words: “Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.”[1]

The underlying weakness is CWE-340, in MITRE’s list of common software weaknesses.[2]

Affected versions

NVD’s record doesn’t list version ranges for it; Ivanti’s advisory has them[3]. CISA names the product as Ivanti Connect Secure.

Most families won’t have Ivanti Connect Secure; it’s for whoever looks after IT at work.

Exploitation

CISA added it to its catalog of known exploited vulnerabilities on 30 Oct 2026. CISA lists a flaw only when it has reliable evidence of it being exploited, and gave US federal agencies until 13 Nov 2026 to fix it.[1]

CISA doesn’t say who was attacked, or how.

Fix

Ivanti has published a fix or advice.[3] CISA’s required action: “Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).”[1]

  1. Check whether you use it.Ivanti Connect Secure is business software or equipment, so most families won’t have it. If you run a business, or work from home on company equipment, ask whoever looks after your IT.
  2. Send this page to your IT person.Ask them to confirm it’s fixed, or not in use. CISA gave US government agencies until 13 Nov 2026 to fix it.
  3. If it can’t be fixed, take it offline.CISA’s advice when there’s no fix is to stop using the product, or take it off the internet, until there is one.

You can’t fix someone else’s server, but you can watch for what follows a break-in like this: a breach notice, a password reset you didn’t ask for, or a scam message that knows things it shouldn’t. HARD watches for those for you and your family.

Timeline

DateEvent
CISA adds it to its catalog of flaws known to be used in attacks.[1]
CISA’s deadline for US government agencies to fix it.[1]

See also

Other Ivanti Connect Secure flaws

Other Ivanti flaws

  • CVE-2026-10520, Ivanti Sentry: OS command injection ·
  • CVE-2026-6973, Ivanti Endpoint Manager Mobile (EPMM): improper input validation ·
  • CVE-2026-1340, Ivanti Endpoint Manager Mobile (EPMM): code injection ·
  • CVE-2026-1603, Ivanti Endpoint Manager (EPM): authentication bypass ·
  • CVE-2026-1281, Ivanti Endpoint Manager Mobile (EPMM): code injection ·

Added the same day

  • CVE-2026-111357, Ivanti Connect Secure: missing authentication for critical function ·

Every Ivanti flaw on CISA’s list · Everything added in October 2026

References

  1. ^ Cybersecurity and Infrastructure Security Agency. “Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability”. Known Exploited Vulnerabilities Catalog, added 30 Oct 2026.
  2. ^ National Institute of Standards and Technology. “CVE-2026-118527 Detail”. National Vulnerability Database.
  3. ^ Ivanti. Advisories and fixes: hub.ivanti.com.
  4. CVE Program. “CVE-2026-118527”. The official CVE record.

This article is built from CISA’s catalog (version 2026.10.30), NVD’s record and FIRST’s scores, kept in HARD’s database and checked every morning. The plain English is HARD’s.