Source: cisa.gov
Ivanti Connect Secure contains a vulnerability involving the generation of predictable numbers or identifiers (CVE-2026-118527), allowing a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability is notable for its chaining potential with two additional CVEs: CVE-2026-104935 and CVE-2026-111357, increasing overall exploitability and impact. The vulnerability is tracked by CISA and is subject to BOD 26-04, which mandates prioritizing security updates based on risk. Forensic triage requirements have also been outlined by CISA for affected organizations. The issue is documented on the NVD and has an official security advisory from Ivanti. Organizations using Ivanti Connect Secure are urged to apply patches and follow CISA guidance immediately. The current risk level is rated High.
