CVE-2026-118527

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-118527 is a vulnerability in Ivanti Connect Secure (ICS) VPN appliances involving the generation of predictable numbers or identifiers, specifically manifesting as a predictable-filename weakness. This flaw allows a remote authenticated attacker to upload files containing attacker-controlled content to a known, predictable location on the local disk. In real-world attacks, threat actors (such as the group tracked as UTA0576) have chained this vulnerability with CVE-2026-104935 (an authentication bypass) and CVE-2026-111357 (a privilege escalation flaw) to gain unauthenticated root access to appliances and extract sensitive Active Directory credentials. Due to active exploitation in the wild, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-118527 to its Known Exploited Vulnerabilities (KEV) catalog on October 30, 2026. Ivanti has released security updates, such as Connect Secure versions 22.8R2.6 and 25.1.1.3, to address the issue.

Description
-

Social media

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score

15

  1. 💣Ivanti Connect Secure: update now and plan network and memory forensics. CISA says Ivanti's Integrity Checker Tool may not detect CVE-2026-104935 exploitation. CVE-2026-111357 and CVE-2026-118527 joined KEV on Oct 30. Scale not stated. https://t.co/RQwZBU4hte

    @umbrasecdev

    31 Oct 2026

    1 Impression

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. CISA added two Ivanti Connect Secure flaws to its exploited list: CVE-2026-111357 (privilege escalation) and CVE-2026-118527 (file write). Ivanti says attackers chained them with CVE-2026-104935. Affects 25.1.1.2 and earlier, 22.8R2.5 and earlier. Fixed in 25.1.1.3 and 22.8R2.6.

    @newswithai_hq

    31 Oct 2026

    38 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. Ivanti VPN alert: CISA added CVE-2026-111357 and CVE-2026-118527 to KEV today, the rest of the exploited CVE-2026-104935 chain. Patched Oct 13? You still need the Oct 29 update. Then run the Integrity Checker and rotate creds stored on the VPN. https://t.co/tiAwOeiXJD https://t.c

    @cyberninja365

    31 Oct 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. 🔒 #CyberSecurity CVE-2026-111357 & CVE-2026-118527: Ivanti Connect Secure Zero-Day Exploitation … "On October 30, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two…" 🔗 https://t.co/hLrYSvhpMg #CyberSecurity #ThreatIntel #critical #zerod

    @SecurityAr58409

    31 Oct 2026

    59 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  5. ⚠️ Ivanti Connect Secure: cadena zero-day explotada activamente (CVE-2026-104935, CVE-2026-111357 y CVE-2026-118527) permite root remoto sin autenticación. Actualiza a 25.1.1.3, 25.1.3.1 o 22.8R2.6; el parche del 13/10 no basta. #Ivanti https://t.co/HcPOpOdOUt

    @BeaconLabMX

    31 Oct 2026

    5 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. 🔒 #CyberSecurity CVE-2026-118527: Ivanti Connect Secure Exploited in the Wild — KEV-Listed Chain… "On October 30, 2026, CISA added CVE-2026-118527 — a Generation of Predictable…" 🔗 https://t.co/zUXW5wQZYU #CyberSecurity #ThreatIntel #cve2026118527 #critical #cis

    @SecurityAr58409

    31 Oct 2026

    37 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. 🚨 CISA ADDS 2 MORE IVANTI CONNECT SECURE FLAWS TO KEV, EXPLOITED IN CHAIN (CVE-2026-111357, CVE-2026-118527) CISA added two more Ivanti Connect Secure (ICS) VPN bugs to its Known Exploited Vulnerabilities catalog today, based on evidence of active exploitation. Both chain wit

    @DailyDarkWeb

    30 Oct 2026

    3543 Impressions

    1 Retweet

    4 Likes

    1 Bookmark

    0 Replies

    1 Quote

  8. #NØØT_Security_Alerts 🚨 #ALERT — Ivanti VPN: Two Chained Flaws Enter CISA KEV October 30, 2026 PRODUCT: Ivanti Connect Secure. CVEs: CVE-2026-111357 (HIGH; Ivanti 8.8 / MITRE 7.0); CVE-2026-118527 (MEDIUM; Ivanti 4.3). AFFECTED: 25.1.1.2 and earlier; 22.8R2.5 and earlier.

    @Python_s_

    30 Oct 2026

    66 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  9. cybersecurity authorities have added two Ivanti Connect Secure vulnerabilities — CVE-2026-111357 and CVE-2026-118527 — to the government's Known Exploited Vulnerabilities catalog, citing evidence that... https://t.co/qqjK3D63Fx #Ivanti #PrivilegeEscalation #KEV #CVE #InfoSec

    @CveTodo

    30 Oct 2026

    50 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  10. CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list today. Chained with CVE-2026-104935, they let attackers get root on the VPN with no login. Patch now and check for compromise. https://t.co/xrWKT77B2y #cybersecurity #infosec

    @FirewallFreddy

    30 Oct 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  11. CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its KEV catalog today. Both chain with CVE-2026-104935. Affected: versions before 25.1.1.3, 25.1.3.1 and 22.8R2.6. Upgrade, then check for compromise beyond the Integrity Checker. https://t.co/fMqRKEiMXp

    @DailyCyberNews_

    30 Oct 2026

    12 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  12. 🚨 CISA adds two more Ivanti Connect Secure VPN flaws to KEV: CVE-2026-111357 (root) and CVE-2026-118527 (file upload), exploited with auth bypass CVE-2026-104935 found by @Volexity. Fixes out since Oct 29. Due Nov 2/Nov 13, plus forensic triage. https://t.co/qqSHYp8ITH

    @CipherSecurityN

    30 Oct 2026

    4 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  13. NØØT KEV Shift Classification: Critical CVE: CVE-2026-118527 Product: Ivanti / Connect Secure Summary: Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with

    @Python_s_

    30 Oct 2026

    46 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  14. 🛡️We added Ivanti Connect Secure vulnerabilities CVE-2026-111357 & CVE-2026-118527 to our KEV Catalog. Visit https://t.co/myxOwap1Tf & apply mitigations to protect your org. #Cybersecurity #InfoSec https://t.co/YcWjCUejog

    @CISACyber

    30 Oct 2026

    6034 Impressions

    8 Retweets

    25 Likes

    4 Bookmarks

    4 Replies

    4 Quotes

  15. Ivanti Connect Secure admins: apply Ivanti's mitigations for CVE-2026-111357. CISA added it to KEV today, due Nov 2. Root escalation on 22.8R2.4, exploited in the wild (CVE record). Chains with CVE-2026-104935 and CVE-2026-118527. CVSS 3.1: 7.0 (CNA) https://t.co/lzsNW2JjP9 htt

    @EmunaEliran

    30 Oct 2026

    57 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  16. 🚨 CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to KEV. Ivanti says attacks chained them with auth bypass CVE-2026-104935. Update to 25.1.1.3 or 22.8R2.6. Volexity says the Integrity Checker may not spot this chain. https://t.co/bXVAWYjjYo #Ivanti #CVE

    @vulnpulse_app

    30 Oct 2026

    2 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

References

Sources include official advisories and independent security research.