Exploited vulnerability

CVE-2026-118527

TLP:CLEAR

Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.

Facts

Vendor: Ivanti
Product: Connect Secure
On CISA's Known Exploited Vulnerabilities list since: 30 October 2026
First known exploitation: 30 October 2026
CISA's deadline for US federal agencies: 13 November 2026
Weakness: CWE-340
First seen by Risk Letters: 30 October 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD