Live › vulnerability › CVE-2026-118527
Ivanti Connect Secure (ICS) VPN appliances write uploaded files to a predictable path before validating them (CWE-340, Ivanti CVSS 4.3). Volexity's analysis shows the wu.cgi upload handler writing to /home/runtime/tmp/<MD5(filename)> and checking for a valid ZIP only afterwards, so an attacker can race to run the file. On its own the flaw needs a login, but UTA0576 chained it with the auth bypass CVE-2026-104935 and the root escalation CVE-2026-111357 to get unauthenticated root on fully patched 22.8R2.4 appliances from 3 Oct 2026. They then stole LDAP/AD credentials, LAPS passwords and BitLocker keys. Ivanti fixed it on 29 Oct 2026 in 25.1.1.3 and 22.8R2.6. CISA added it to KEV on 30 Oct (due 13 Nov).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Organisations that run an Ivanti Connect Secure VPN gateway on 25.1.1.2 or earlier, or 22.8R2.5 or earlier, are exposed. Because the bug chains with the CVE-2026-104935 auth bypass, an internet-facing login page is enough on boxes not yet on the 13 Oct fixes. Appliances tied to Active Directory over LDAP are the ones attackers mined for credentials. You can skip it if you are on 22.7.x or earlier, on 25.1.3.0 or later, or do not use Ivanti Connect Secure at all.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Ivanti Connect Secure | vendor |
| – |
| – |
| Ivanti Connect Secure | vendor | <= 25.1.1.2 (25.1.1.x line); <= 22.8R2.5 (22.8 line) | 25.1.1.3, 22.8R2.6 |
25.1.1.2 or earlier on the 25.1.1.x line (ISA6000/ISA8000) or 22.8R2.5 or earlier on the 22.8 line25.1.3.0+ (new ISA4500/6500/8500 platform) do not contain the issue25.1.2.x, ask Ivanti or move to 25.1.3.x: the advisory row for this CVE does not list that line25.1.1.3 (25.1.1.x on ISA6000/ISA8000), or 22.8R2.6 on the 22.8 line25.1.1.3 or later over 22.8R2.6. 22.7 and 22.8 reach end of life on 31 Jan 2027. 25.1.3.0+ requires the new ISA4500/6500/8500 hardware or a new VM/cloud build from the 25.1.3.0 templateEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
This page as .md · .json · in your agent: get_signal("CVE-2026-118527")
CISA KEV catalog, Creative Commons 0. Posts quoted belong to their authors.