CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

CISA's catalog says the flaw "allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk."[3] The Hacker News reports that the flaw has a CVSS score of 4.3[2].SecurityOnline describes the attack chain this way: the main flaw, CVE-2026-104935 (CVSS 8.6), stems from authentication bypass by spoofing in the web components[4]. The outlet says attackers then use CVE-2026-118527 and finally CVE-2026-111357 (CVSS 8.8)[4], which it says elevates privileges to root[4].SecurityOnline quotes Ivanti as saying it is "aware of exploitation in the wild affecting a limited number of customers"[4] when the three flaws are chained. CISA says attackers are using these vulnerabilities to conduct credential theft and data exfiltration[1].According to Security Affairs, Ivanti's fixes are: version 25.1.1.2 and earlier should upgrade to 25.1.1.3[5], and version 22.8R2.5 and earlier should upgrade to 22.8R2.6[5]. SecurityOnline reports that versions 22.7.x and lower do not contain these vulnerabilities[4].Ivanti told customers it initially focused on CVE-2026-104935 because it wanted to provide "protection for our customers as quickly as possible,"[2] The Hacker News reports.The Hacker News says federal civilian agencies must fix CVE-2026-118527 by November 13, 2026[2]. CISA warns that organisations checking for compromise will need to conduct network and memory forensics[1].