CVE-2026-118527 Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location....
MediumCVSS 4.3
EPSS 0.82%
CISA KEV
added 2026-10-30 · due 2026-11-13
Exploited in the wild
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
CISA Known Exploited Vulnerability
- Date added
- 2026-10-30
- Due date (FCEB)
- 2026-11-13
- Ransomware use
- Unknown
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Ivanti Connect Secure | >= 25.1.0.0, < 25.1.1.3 | 25.1.1.3 |
| Ivanti Connect Secure | = 22.8-r2 | No fix listed |
| Ivanti Connect Secure | = 22.8-r2.1 | No fix listed |
| Ivanti Connect Secure | = 22.8-r2.2 | No fix listed |
| Ivanti Connect Secure | = 22.8-r2.3 | No fix listed |
| Ivanti Connect Secure | = 22.8-r2.4 | No fix listed |
| Ivanti Connect Secure | = 22.8-r2.5 | No fix listed |
References
- hub.ivanti.com vendor-advisory
- www.cisa.gov government-resource us-government-resource