--- id: "CVE-2026-118527" kind: "vulnerability" aliases: ["CVE-2026-118527"] title: "Ivanti Connect Secure: predictable identifiers let authenticated attackers upload attacker-controlled files" severity: "high" cvss: null epss: null exploited: true status: "open" category: "vendor" products: [{"name": "Ivanti Connect Secure", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Ivanti Connect Secure", "fixed": ["25.1.1.3", "22.8R2.6"], "affected": "<= 25.1.1.2 (25.1.1.x line); <= 22.8R2.5 (22.8 line)", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["active-directory", "chained", "edge-device", "exploited", "ivanti", "ivanti-connect-secure", "self-hosted", "vendor", "vpn"] not_affected_if: ["ics-22.7-or-earlier", "ics-25.1.3-or-later", "unknown"] published_at: "2026-10-30T00:00:00+00:00" first_seen_at: "2026-10-30T19:25:20+00:00" updated_at: "2026-10-30T19:28:13+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-118527", "first_seen_at": "2026-10-30T19:25:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T19:28:13+00:00"}] --- # Ivanti Connect Secure: predictable identifiers let authenticated attackers upload attacker-controlled files Ivanti Connect Secure (ICS) VPN appliances write uploaded files to a predictable path before validating them (CWE-340, Ivanti CVSS 4.3). Volexity's analysis shows the wu.cgi upload handler writing to /home/runtime/tmp/ and checking for a valid ZIP only afterwards, so an attacker can race to run the file. On its own the flaw needs a login, but UTA0576 chained it with the auth bypass CVE-2026-104935 and the root escalation CVE-2026-111357 to get unauthenticated root on fully patched 22.8R2.4 appliances from 3 Oct 2026. They then stole LDAP/AD credentials, LAPS passwords and BitLocker keys. Ivanti fixed it on 29 Oct 2026 in 25.1.1.3 and 22.8R2.6. CISA added it to KEV on 30 Oct (due 13 Nov). _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Ivanti Connect Secure affected ? fixed ? - vendor:Ivanti Connect Secure affected <= 25.1.1.2 (25.1.1.x line); <= 22.8R2.5 (22.8 line) fixed 25.1.1.3, 22.8R2.6 ## How to check Check the version your ICS appliance is running in the admin console. You are exposed if it is 25.1.1.2 or earlier on the 25.1.1.x line (ISA6000/ISA8000) or 22.8R2.5 or earlier on the 22.8 line. Per Ivanti, 22.7.x and lower and 25.1.3.0+ (new ISA4500/6500/8500 platform) do not contain the issue. If you were on 25.1.2.x, ask Ivanti or move to 25.1.3.x: the advisory row for this CVE does not list that line. To check for compromise, do not rely on the Integrity Checker Tool alone. Volexity says this chain patches code in memory and restores config, so ICT shows nothing. Look in web or proxy logs for requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header that names /home/webserver/htdocs/dana/fb/smb/wu.cgi or /home/runtime/tmp/. Also look for LDAP queries from the appliance's AD service account for LAPS or BitLocker attributes, and for files such as /tmp/ml.py, /tmp/rq5.py or /data/.icscap/h.py. Ivanti says customers who suspect compromise should follow its recovery steps. ## Fix Upgrade to ICS 25.1.1.3 (25.1.1.x on ISA6000/ISA8000), or 22.8R2.6 on the 22.8 line. Both resolve all three chained CVEs (104935, 111357, 118527), per Ivanti's advisory updated 29 Oct 2026. Downloads are in ILS. Ivanti recommends 25.1.1.3 or later over 22.8R2.6. 22.7 and 22.8 reach end of life on 31 Jan 2027. 25.1.3.0+ requires the new ISA4500/6500/8500 hardware or a new VM/cloud build from the 25.1.3.0 template. Patching does not clean an appliance that was already compromised. Because this chain stole AD credentials, also rotate the appliance's LDAP/AD service-account password and review LAPS/BitLocker exposure. ## Timeline - 2026-10-30T19:25:20+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-118527 - 2026-10-30T19:28:13+00:00 analyst — Ivanti hub advisory 000109571 (CVE-2026-104935 page, updated 29 Oct), read via browser: CVE-2026-118527 affects 25.1.1.2 and prior and 22.8R2.5 and prior, fixed in 25.1.1.3 and 22.8R2.6; 22.7.x and 25.1.3.0+ not affected. Versions verified there. Mapping to Volexity's wu.cgi predictable /home/runtime/tmp/ upload race is inferred, not stated by Ivanti. 25.1.2.x status for this CVE is not in Ivanti's row (Canada AV26-1035 says prior to 25.1.3.1). Severity kept high despite vendor's 4.3 because it is exploited in the wild in an unauthenticated root chain. KEV entry and BOD 26-04 linked; KEV says forensic triage not required for this CVE (required for 111357). No vendor WAF/platform mitigations, no public PoC found. X shows only reposts of the advisory title. Same chain as sibling CVE-2026-111357 (run 1190). ## Documents - [advisory] Security Advisory Ivanti Connect Secure (CVE-2026-104935), updated 29 Oct 2026 with CVE-2026-111357 and CVE-2026-118527 https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US - [advisory] CISA KEV entry CVE-2026-118527 (added 2026-10-30, due 2026-11-13) https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-118527 - [describes] Volexity: A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days (UTA0576) https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/ - [mentions] CISA BOD 26-04: Prioritizing Security Updates Based on Risk https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk - [mentions] CISA Adds Two Known Exploited Vulnerabilities to Catalog (30 Oct 2026) https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog ## From the sources Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_