{"affected":[{"defaultStatus":"affected","product":"Connect Secure","source":"CNA: ivanti","vendor":"Ivanti","versions":[{"status":"unaffected","version":"25.1.1.3"},{"status":"unaffected","version":"22.8R2.6"}]}],"cveId":"CVE-2026-118527","cwes":["CWE-340"],"description":"Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.","epss":null,"exploits":[],"kev":{"addedAt":1793318400000,"dueDateAt":1794528000000,"knownRansomwareUse":false,"product":"Connect Secure","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","shortDescription":"Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.","vendor":"Ivanti","vulnerabilityName":"Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability"},"metrics":[{"score":4.3,"severity":"medium","source":"CNA: ivanti","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1793719976011,"publishedAt":1793717608232,"references":[{"source":"CNA: ivanti","tags":[],"url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US"},{"source":"ADP: CISA-ADP","tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-118527"}],"remediation":[],"revision":"4230a5e7eac0aa1253441cbb4d5ae967abe90d94b0700655fbbe937bce3885eb","sources":[{"modifiedAt":1793719976011,"name":"CNA: ivanti","retrievedAt":1793722135189,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118527"},{"modifiedAt":null,"name":"CISA KEV","retrievedAt":1793593222510,"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}],"ssvc":{"assessedAt":1793719935250,"automatable":"no","exploitation":"active","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability","updatedAt":1793722135189}