CVE-2026-118527
Ivanti Connect Secure
What this is
Ivanti Connect Secure uses predictable file names. This lets an attacker upload files containing content they choose to a known location on the server's disk.
How it can harm you
An attacker who can sign in and reach the program over a network can place files with their own content on disk. No action by another user is needed. The permissions needed to sign in are not specified.
How urgent it is
This vulnerability is already being used in attacks. Address it promptly to prevent someone with sign-in access from placing unwanted files on your server.
Who is affected
Connect Secure versions before 25.1.1.3 and 22.8R2.6 are affected in their respective release branches. Versions 25.1.1.3 and 22.8R2.6 are listed as unaffected.
What to do
Consult the Ivanti advisory for verified remediation and the appropriate release to install. No fixed release or workaround is explicitly specified.
How to check your server
Find the installed Connect Secure version in its product information, then compare the full version and release branch with the affected versions in the Ivanti advisory.
Technical details
- CVE
- CVE-2026-118527
- Published
- November 3, 2026
- CWE
- CWE-340
- CVSS
- 4.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 0.8% chance of an attack attempt in the next 30 days
- Attack evidence
- attacks observed
CVSS measures technical severity on a scale up to 10. Attack conditions and urgency are explained above.
EPSS estimates the chance of an exploitation attempt in the next 30 days, not the chance of your server being breached.