Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to…
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- Yes, on CISA KEV
- Fix
- No fix listed
- Who is exposed
- Not reported
Do first: Fix it by , CISA's deadline for US federal agencies.
- Exploitation40/40Listed in CISA's Known Exploited Vulnerabilities catalog
- Exposure18/25Actively exploited, reachable over the network
- Reach14/20Affects Ivanti (an enterprise product or network appliance)
- Severity4.3/10CVSS 4.3
- No patch5/5No patch listed yet
What would change the score
- Would score about 88 if CISA's SSVC rates it automatable
CVE-2026-118527 is being exploited: CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-30, with a fix due by 2026-11-13. No public exploit code is tracked. It is rated CVSS 4.3 (medium) and affects Connect Secure; no fixed version is listed yet.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 81/100 · #76 in the past year · provisional
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: active
- Automatable: no
- Technical impact: partial
Summary
Ivanti Connect Secure, a remote access VPN product, is affected by this vulnerability. An authenticated remote attacker could exploit predictable filenames to upload files with attacker-controlled content to a known location on the system's disk.
Read the original description
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
Impact
- Exposed online
“Internet threat watchdog Shadowserver now tracks over 5,000 Internet-exposed ICS instances”Source: bleepingcomputer.com
What to do
Fix it by , CISA's deadline for US federal agencies.
Timeline
- Added to CISA KEV
CISA has evidence of exploitation in the wild
4 days - CVE published
- First seen by cve.now
- Posted on X by cve.now
- CISA SSVC assessment
Exploitation: active · Automatable: no · Technical impact: partial
- Record last updated10 days
- CISA remediation deadline
Due date for US federal agencies to patch
Affected versions
- Ivanti Connect Secure
Version range not reported
Evidence 1
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.