{"id":"CVE-2026-118527","kind":"vulnerability","aliases":["CVE-2026-118527"],"related":[],"title":"Ivanti Connect Secure: predictable identifiers let authenticated attackers upload attacker-controlled files","description":"Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Ivanti Connect Secure (ICS) VPN appliances write uploaded files to a predictable path before validating them (CWE-340, Ivanti CVSS 4.3). Volexity's analysis shows the wu.cgi upload handler writing to /home/runtime/tmp/<MD5(filename)> and checking for a valid ZIP only afterwards, so an attacker can race to run the file. On its own the flaw needs a login, but UTA0576 chained it with the auth bypass CVE-2026-104935 and the root escalation CVE-2026-111357 to get unauthenticated root on fully patched 22.8R2.4 appliances from 3 Oct 2026. They then stole LDAP/AD credentials, LAPS passwords and BitLocker keys. Ivanti fixed it on 29 Oct 2026 in 25.1.1.3 and 22.8R2.6. CISA added it to KEV on 30 Oct (due 13 Nov).","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-30T00:00:00+00:00","products":[{"name":"Ivanti Connect Secure","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Ivanti Connect Secure","fixed":["25.1.1.3","22.8R2.6"],"affected":"<= 25.1.1.2 (25.1.1.x line); <= 22.8R2.5 (22.8 line)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["active-directory","chained","edge-device","exploited","ivanti","ivanti-connect-secure","self-hosted","vendor","vpn"],"not_affected_if":["ics-22.7-or-earlier","ics-25.1.3-or-later","unknown"],"how_to_check":"Check the version your ICS appliance is running in the admin console. You are exposed if it is 25.1.1.2 or earlier on the 25.1.1.x line (ISA6000/ISA8000) or 22.8R2.5 or earlier on the 22.8 line. Per Ivanti, 22.7.x and lower and 25.1.3.0+ (new ISA4500/6500/8500 platform) do not contain the issue. If you were on 25.1.2.x, ask Ivanti or move to 25.1.3.x: the advisory row for this CVE does not list that line. To check for compromise, do not rely on the Integrity Checker Tool alone. Volexity says this chain patches code in memory and restores config, so ICT shows nothing. Look in web or proxy logs for requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header that names /home/webserver/htdocs/dana/fb/smb/wu.cgi or /home/runtime/tmp/. Also look for LDAP queries from the appliance's AD service account for LAPS or BitLocker attributes, and for files such as /tmp/ml.py, /tmp/rq5.py or /data/.icscap/h.py. Ivanti says customers who suspect compromise should follow its recovery steps.","fix":"Upgrade to ICS 25.1.1.3 (25.1.1.x on ISA6000/ISA8000), or 22.8R2.6 on the 22.8 line. Both resolve all three chained CVEs (104935, 111357, 118527), per Ivanti's advisory updated 29 Oct 2026. Downloads are in ILS. Ivanti recommends 25.1.1.3 or later over 22.8R2.6. 22.7 and 22.8 reach end of life on 31 Jan 2027. 25.1.3.0+ requires the new ISA4500/6500/8500 hardware or a new VM/cloud build from the 25.1.3.0 template. Patching does not clean an appliance that was already compromised. Because this chain stole AD credentials, also rotate the appliance's LDAP/AD service-account password and review LAPS/BitLocker exposure.","status":"open","published_at":"2026-10-30T00:00:00+00:00","first_seen_at":"2026-10-30T19:25:20+00:00","triaged_at":"2026-10-30T19:25:41+00:00","updated_at":"2026-10-30T19:28:13+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-10-30T19:25:41Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Ivanti Connect Secure: predictable identifiers let authenticated attackers upload attacker-controlled files","impact":"high","summary":"Ivanti Connect Secure generates predictable numbers or identifiers, letting a remote authenticated attacker upload files with attacker-controlled content to a known location on disk. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog and can be chained with CVE-2026-104935 and CVE-2026-111357.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ivanti-connect-secure","vpn","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker plants files on disk, enabling further compromise when chained","analyst_note":"Find the affected and fixed Ivanti Connect Secure versions and vendor advisory, and the CISA BOD 26-04 page linked in the KEV entry.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Ivanti Connect Secure, the VPN gateway product named in the sources. The sources do not say which versions are affected or which configurations are exposed. CISA requires federal agencies to evaluate each asset's internet exposure and follow BOD 26-04 guidance.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":4364,"output_tokens":532,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the affected and fixed Ivanti Connect Secure versions and vendor advisory, and the CISA BOD 26-04 page linked in the KEV entry.","search":"'-04':230C,256C,287C '-104935':113B,208C '-111357':120B,212C '-118527':16A,19A '-2026':15A,18A,112B,119B,207C,211C '-340':61B '/home/runtime/tmp':75B '13':166B '2026':134B,151B '22.8':128B,155B '25.1.1.3':153B '26':229C,255C,286C '29':149B '3':132B '30':163B '4.3':64B 'accord':219C 'action':215C 'activ':27B 'active-directori':26B 'add':158B 'adher':283C 'afterward':85B 'allow':181C 'analysi':67B 'appli':216C 'applianc':49B,130B 'applic':253C 'asset':277C 'attack':8A,11A,88B,185C,191C 'attacker-control':10A,190C 'auth':109B 'authent':7A,184C 'base':234C 'bitlock':143B 'bod':228C,254C,285C 'bypass':110B 'chain':29B,105B,204C 'check':79B 'cisa':157B,213C,226C,243C 'cloud':259C 'complianc':224C 'connect':2A,21A,24A,37B,45B,169C 'contain':171C 'content':193C 'control':12A,192C 'credenti':139B 'cve':14A,17A,111B,118B,206C,210C 'cvss':63B 'cwe':60B 'devic':32B 'directori':28B 'discontinu':262C 'disk':199C 'due':165B 'edg':31B 'edge-devic':30B 'ensur':223C,282C 'escal':117B 'evalu':275C 'exploit':33B 'exposur':280C 'file':13A,52B,94B,188C 'filenam':77B 'fix':146B 'flaw':99B 'follow':252C 'forens':245C 'fulli':126B 'generat':173C 'get':122B 'guidanc':241C,257C 'guidelin':289C 'handler':72B 'host':41B 'ic':47B 'identifi':5A,178C 'instruct':222C 'internet':279C 'ivanti':1A,20A,23A,34B,36B,44B,62B,145B,168C 'ivanti-connect-secur':35B 'kev':161B 'key':144B 'known':196C 'lap':140B 'ldap/ad':138B 'let':6A 'locat':197C 'login':102B 'md5':76B 'mitig':217C,268C 'need':100B 'note':240C,251C 'nov':167B 'number':176C 'oct':133B,150B,164B 'password':141B 'patch':127B,288C 'path':56B 'predict':4A,55B,175C 'priorit':231C 'product':266C 'r2.4':129B 'r2.6':156B 'race':90B 'remot':183C 'requir':214C,247C 'respons':273C 'risk':236C 'root':116B,124B 'run':92B 'secur':3A,38B,46B,170C,232C 'secure':22A,25A 'see':237C,248C 'self':40B 'self-host':39B 'servic':260C 'show':68B 'stakehold':271C 'stole':137B 'triag':246C 'unauthent':123B 'unavail':270C 'updat':233C 'upload':9A,51B,71B,187C 'url':238C,249C 'use':263C 'uta0576':104B 'valid':58B,82B 'vendor':42B,221C 'volex':65B 'vpn':43B,48B 'vulner':179C,201C 'write':50B,73B 'wu.cgi':70B 'zip':83B","nicknames":[],"mitigations":[],"who_affected":"Organisations that run an Ivanti Connect Secure VPN gateway on 25.1.1.2 or earlier, or 22.8R2.5 or earlier, are exposed. Because the bug chains with the CVE-2026-104935 auth bypass, an internet-facing login page is enough on boxes not yet on the 13 Oct fixes. Appliances tied to Active Directory over LDAP are the ones attackers mined for credentials. You can skip it if you are on 22.7.x or earlier, on 25.1.3.0 or later, or do not use Ivanti Connect Secure at all.","tier":"A","verified":{"fix":{"at":"2026-10-30T19:28:13Z","by":"analyst","doc":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-118527","run_id":1191},"products":{"at":"2026-10-30T19:28:13Z","by":"analyst","doc":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-118527","run_id":1191},"who_affected":{"at":"2026-10-30T19:28:13Z","by":"analyst","doc":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-118527","run_id":1191}},"analyst_revisit_at":"2026-10-31T01:28:25+00:00","fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T00:00:00+00:00","kev":{"dateAdded":"2026-10-30","dueDate":"2026-11-13","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-118527","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-118527","severity":null,"published_at":"2026-10-30T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-30T19:25:20+00:00","fetched_at":"2026-10-30T20:25:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118527:1191","url":null,"severity":null,"published_at":"2026-10-30T19:28:13+00:00","modified_at":"2026-10-30T19:28:13+00:00","first_seen_at":"2026-10-30T19:28:13+00:00","fetched_at":"2026-10-30T19:28:13+00:00","note":"Ivanti hub advisory 000109571 (CVE-2026-104935 page, updated 29 Oct), read via browser: CVE-2026-118527 affects 25.1.1.2 and prior and 22.8R2.5 and prior, fixed in 25.1.1.3 and 22.8R2.6; 22.7.x and 25.1.3.0+ not affected. Versions verified there. Mapping to Volexity's wu.cgi predictable /home/runtime/tmp/<MD5> upload race is inferred, not stated by Ivanti. 25.1.2.x status for this CVE is not in Ivanti's row (Canada AV26-1035 says prior to 25.1.3.1). Severity kept high despite vendor's 4.3 because it is exploited in the wild in an unauthenticated root chain. KEV entry and BOD 26-04 linked; KEV says forensic triage not required for this CVE (required for 111357). No vendor WAF/platform mitigations, no public PoC found. X shows only reposts of the advisory title. Same chain as sibling CVE-2026-111357 (run 1190)."}],"documents":[{"id":25501,"url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US","title":"Security Advisory Ivanti Connect Secure (CVE-2026-104935), updated 29 Oct 2026 with CVE-2026-111357 and CVE-2026-118527","kind":"advisory","source":"analyst","publisher":null,"text":"Security Advisory Ivanti Connect Secure (CVE-2026-104935) — Ivanti Innovators Hub, Article 000109571\nCreated Oct 13, 2026; Last Modified Oct 29, 2026 4:45 PM. (Text captured via browser; page is JavaScript-rendered.)\n\nUpdate 29 Oct: Updated versions of Ivanti Connect Secure have been released which address two additional vulnerabilities.\n\nSummary: Ivanti has released updates for Ivanti Connect Secure (ICS) which addresses two high severity vulnerabilities and one medium severity vulnerability. We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure when CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 are chained. Fixed versions are available now.\n\nCVE-2026-104935 — Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior. 8.6 (High) CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CWE-290\nCVE-2026-111357 — Missing authentication for a critical function in Ivanti Connect Secure before version 25.1.1.3, and 22.8R2.6 allows a local authenticated attacker to escalate their privileges. 8.8 (High) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CWE-306, CWE-862, CWE-345\nCVE-2026-118527 — Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. 4.3 (Medium) CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CWE-340\n\nAffected Versions\nCVE-2026-104935: ICS 25.1.1.1 and prior; 25.1.2.2 and prior; 22.8R2.4 and prior -> Resolved 25.1.1.2; 25.1.3.0, 25.1.3.1; 22.8R2.5. Download Available in ILS.\nCVE-2026-111357 & CVE-2026-118527: ICS 25.1.1.2 and prior; 22.8R2.5 and prior -> Resolved 25.1.1.3; 22.8R2.6. Download Available in ILS.\n\nSolution: Customers can resolve these vulnerabilities by updating their solution to one of the resolved versions of code.\n- Versions 22.7.X and lower do not contain this vulnerability. 22.7 reaches end of life on January 31, 2027, and customers should plan to transition to 25.1 line of code before that date.\n- 22.8.X – Ivanti recommends customers update to 25.1.1.3 or later. ... 22.8 reaches end of life on January 31, 2027 ... For those who are unable to move immediately to 25.1.1.3, customers can upgrade to 22.8R2.6 which resolves all vulnerabilities in this disclosure.\n- 25.1.1.1 (ISA6000 or ISA8000) – update to 25.1.1.3 which resolves all vulnerabilities in this disclosure.\n- 25.1.3.0 (released July 2026 and running on ISA4500, ISA6500 or ISA8500) or later do not contain this vulnerability.\nNOTE: For customers who will be migrating to 25.1.3.0, the new platform is required (ISA4500, ISA6500 or ISA8500). Virtual or cloud devices need new devices built from the 25.1.3.0 template.\n\nFAQ: Exploitation affecting a limited number of customers at the time of disclosure. How can I tell if I have been compromised? Limited indicators of compromise available. Review indicators in Volexity's blog post and run the Integrity Checker Tool regularly. Customers who suspect exploitation should follow the recovery steps.\nWhy not disclosed at same time: fix for CVE-2026-104935 was already in QA; LPE discovered later; additional CVEs now added, fix available.\nIvanti initially discovered a portion of this vulnerability as part of our product security program and patched it in the July release 25.1.3.0.\nAcknowledgements: Volexity.\n","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":25503,"url":"https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/","title":"Volexity: A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days (UTA0576)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":25506,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-118527","title":"CISA KEV entry CVE-2026-118527 (added 2026-10-30, due 2026-11-13)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":25507,"url":"https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","title":"CISA BOD 26-04: Prioritizing Security Updates Based on Risk","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":25505,"url":"https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog","title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog (30 Oct 2026)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}