93← Home

CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

Headline from Ivanti — Connect Secure · compiled from 6 sources

Our analysis · checked against 12 sources

Medium-rated Ivanti VPN flaw exploited in chain with two others; CISA orders federal patching

Attackers are exploiting CVE-2026-118527, rated 4.3 of 10 (Medium) and needing a logged-in attacker, by chaining it with two other Ivanti Connect Secure flaws to run commands without authentication, CISA and Ivanti confirm. Fixes are available, federal civilian agencies must patch by November 13, 2026, and one tracker lists no published CVSS score.

The framing"Critical CVE" does fit the flaw's role in an actively exploited chain that CISA added to its Known Exploited Vulnerabilities catalog. But on its own the flaw scores 4.3 of 10 (Medium) and requires an authenticated attacker.

What the headline leaves out

  • Alone it is Medium (4.3); trade outlets report the two flaws it is chained with at 8.6 and 8.8 (High).
  • Ivanti says exploitation hit "a limited number of customers."
  • Release 22.8R2.5, which fixed the first flaw, is still listed as affected; fixed versions are 22.8R2.6 and 25.1.1.3.
  • Volexity found the chain on an appliance fully patched at the time (22.8R2.4).

What happens next

Federal civilian agencies must remediate CVE-2026-118527 by November 13, 2026, after a November 2 deadline for CVE-2026-111357. Volexity warns 22.8R2.5 remains affected by the two later flaws, and Volexity and CISA note the attacker deleted log evidence and Ivanti's Integrity Checker Tool may miss in-memory exploitation. Watch for whether CISA escalates beyond patching, as it did in 2024.

Possible knock-on effects
  • If patching proves insufficient, CISA could again order federal agencies to disconnect affected appliances, which may disrupt remote access at those agencies. (precedent: January 2024 Ivanti chaining incident (CVE-2023-46805 with CVE-2024-21887), after which CISA ordered disconnection. Watch for: A CISA emergency directive or disconnection order for Ivanti Connect Secure)
  • Organisations that sort patch queues by CVSS score may defer this 4.3-rated flaw, leaving appliances that fixed only the first flaw (22.8R2.5) open to the full chain. (mechanism: Follows from score-based prioritisation and 22.8R2.5 still being listed as affected. Watch for: New compromise reports on appliances running 22.8R2.5 or earlier 25.1.x releases)

Sources: CISA urges patching newly exploited vulnerabilities in Ivanti Connect Secure (primary), CISA adds two known exploited vulnerabilities to catalog (primary), CISA Known Exploited Vulnerabilities Catalog (primary), Volexity: chained exploitation of Ivanti Connect Secure zero-days (primary), The Hacker News: attackers chain three Ivanti Connect Secure flaws, Security Affairs: CISA adds Ivanti Connect Secure flaws to KEV, VITI Security: Ivanti Connect Secure exploit chain advisory, SecurityOnline: Ivanti Connect Secure vulnerability exploited, SiteGuarding: Ivanti Connect Secure root chain, Secure.com: 22.8R2.5 still affected, Helix threat watch: CVE-2026-118527, GitHub tracker issue 3570

Written in our own words from the sources above, and checked claim by claim before it was published. The report below says only what each outlet said.

The report: what outlets said

CISA reports that cyber threat actors are exploiting these vulnerabilities, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration[1]

CISA's catalog says the flaw lets a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk[2]. It adds that the flaw can be chained with CVE-2026-104935 and CVE-2026-111357.[2]The Hacker News reports that the flaw has a CVSS score of 4.3[3]. It also reports that attackers chained them to gain unauthenticated root-level code execution.[3]SecurityOnline reports that Ivanti said: "We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure"[4] when the three flaws are chained.CISA says it added CVE-2026-104935 to its KEV Catalog on Oct. 13, 2026, and CVE-2026-111357 and CVE-2026-118527 on Oct. 30, 2026.[1] According to The Hacker News, federal civilian agencies must apply the fixes for CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026.[3]Security Affairs reports that users of Version 25.1.1.2 and earlier[5] should upgrade to 25.1.1.3[5], and users of Version 22.8R2.5 and earlier[5] should upgrade to 22.8R2.6.[5]VITI Security reports that threat intelligence firms attribute the exploit chain activity to an undocumented threat actor designated as UTA0576.[6]CISA warns that Ivanti's Integrity Checker Tool may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory.[1]

Listen to the songCritical CVEs — November 02, 2026

Sources

  1. [1]CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure | CISA
  2. [2]Known Exploited Vulnerabilities Catalog | CISA
  3. [3]Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
  4. [4]Ivanti Connect Secure Vulnerability Exploited in the Wild via Zero-Day Chain
  5. [5]U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog - Security Affairs
  6. [6]Ivanti Connect Secure Exploit Chain Advisory | VITI Security

Every sentence here reports what a named outlet said, with a link to it. Compiled by 93 from the reporting below.

More in this topic

This topic, day by day

CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability | 93