← CVE Radar
CVE-2026-118527Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
4.3 MEDIUMEPSS 0.82%⚡ Known Exploited (CISA KEV)NVD: Published
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 4.3 | MEDIUM | 3.1ivanti (CNA) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Details
- CVE ID
- CVE-2026-118527
- Status
- Published
- Assigner (CNA)
- ivanti
- Published
- Nov 3, 2026
- Last modified
- 2026-11-03 15:32 UTC
- Weaknesses
- CWE-340 · Generation of Predictable Numbers or Identifiers
Affected Products
As published by the CNA in the CVE record.
IvantiConnect Secure0 version ranges
No version detail published.
References
Sources
- NVD (unavailable at last refresh)
- CVE.org
- CISA KEV
- FIRST EPSS