CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

CISA says it added CVE-2026-104935 to its KEV Catalog on Oct. 13, 2026, and CVE-2026-111357 and CVE-2026-118527 on Oct. 30, 2026[1]. CVE Security reports that federal agencies have a remediation deadline of Nov. 13, 2026[2].CISA's catalog says the flaw "allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk."[3] According to GBHackers, Ivanti rated CVE-2026-118527 4.3, to predictable-filename file uploads[4].SecurityOnline reports that Ivanti said: "We are aware of exploitation in the wild affecting a limited number of customers"[5] when the three CVEs are chained. According to SecurityOnline, the chain ends with CVE-2026-111357, which elevates privileges to root, giving the attacker unrestricted command over the device[5].Cyber Security News reports that Volexity tracked UTA0576 activity to October 3[6]. GBHackers reports that the attackers targeted Windows LAPS administrator passwords, BitLocker recovery keys, password-bearing attributes, and account metadata[4].GBHackers says Ivanti's October 29 update lists versions 25.1.1.3 and 22.8R2.6 as resolving the disclosed vulnerabilities[4]. CISA says organizations should immediately update to the latest version[1].According to Cyber Security News, Volexity found that memory-only changes and restored settings escaped Ivanti's Integrity Checker[6]. CISA says organizations checking for compromise will need to conduct network and memory forensics[1].