CVE-2026-118527 Hits Ivanti Connect Secure: What to Do

On 30 October 2026 CISA added CVE-2026-118527, the Ivanti Connect Secure "Generation of Predictable Numbers or Identifiers" vulnerability, to its Known Exploited Vulnerabilities catalog — catalog version 2026.10.30. Per CISA, the flaw lets a remote authenticated attacker upload files with attacker-controlled content to a known location on disk, and it can be chained with CVE-2026-104935 and CVE-2026-111357. The fix is Ivanti's vendor patch or mitigation, applied per CISA's BOD 26-04 guidance. The remediation due date is 2026-11-13. If a Connect Secure appliance of yours answers on the public internet, this is a this-week job.

What CVE-2026-118527 actually lets an attacker do

It is a predictability bug: something the appliance generates as a number or identifier can be guessed, and the guess hands an attacker a known location on disk to write into.

Read CISA's description literally — a *remote authenticated* attacker can upload files with attacker-controlled content to a known location. Predictable identifiers are dangerous not because the number itself is secret, but because everything built on top of it, whether a path, a filename or a job reference, stops being secret too. The catalog entry does not state which identifier is predictable, or what an uploaded file can subsequently reach. It also records known ransomware campaign use as "Unknown", which means no ransomware attribution is recorded — not that the bug is unexploited. A KEV listing is CISA's statement that it has evidence of active exploitation.

Am I affected? Checking your Ivanti Connect Secure estate

If you run Ivanti Connect Secure and any instance is reachable from the internet, put it in scope — CISA explicitly makes the asset owner responsible for evaluating each asset's internet exposure.

Start from DNS records and firewall rules rather than from memory. Appliances get stood up for one project, forgotten, and left answering on 443 long after the project closed. Include standby nodes in an HA pair, the DR instance, and anything sitting behind a load balancer that nobody logs into directly. "Authenticated" narrows the entry point but not the blast radius: an account on the appliance — a service account, a stale contractor login, a credential reused from elsewhere — is enough of a starting point. The catalog entry does not specify which privilege level is required, so do not assume a low-privilege account is safe.

The next 24 hours: patch, verify, watch

Apply Ivanti's vendor patch or mitigation to every internet-facing instance today, then prove that the build answering traffic is the build you patched.

• Pull the vendor advisory covering CVE-2026-118527 and CVE-2026-111357 and record the exact build string it names before you touch anything.
• Patch or mitigate every instance, including HA standbys and the DR box nobody visits.
• Verify from three angles: the appliance's own admin page, an external check against the public endpoint, and the load balancer's backend health output. If they disagree, you have a node you missed. Our notes on server hardening cover the verification step in more detail.
• If no mitigation is available, CISA's required action is to follow BOD 26-04 guidance for cloud services or discontinue use of the product — in practice, take it off the internet.
• Afterwards, watch for file writes to unexpected paths, uploads outside maintenance windows, and authentication from unfamiliar locations.

CVE-2026-111357 has the earlier deadline

There are two KEV entries here, not one, and the second is due on 2026-11-02 — eleven days before the headline CVE.

CVE-2026-111357 is a missing authentication for critical function vulnerability: a local authenticated attacker could escalate privileges, and CISA notes it can be chained with CVE-2026-104935 and CVE-2026-118527. A local-only escalation reads as less urgent than remote file upload, but these entries describe a chain, and chains are what turn a modest bug into an appliance takeover. CVE-2026-104935 appears in both entries solely as a chaining partner; the catalog text available here does not describe it, so ask Ivanti or your reseller what it covers rather than assuming. Confirm with the vendor advisory that your target build addresses all three identifiers, then plan the change window against the 2 November date, not the 13th.

What AI changes about finding this class of bug

Nothing about this bug's existence depends on AI, and the catalog entry does not say how it was found. What AI changes is how quickly your own team can find the same pattern in code you wrote.

Predictable-identifier bugs survive review because reviewers read for logic, not entropy. A filename assembled from a timestamp or an auto-increment counter looks correct on the page. An AI-assisted pass over upload and file-handling code, asked specifically where a value derived from time, a counter or a fixed seed reaches a filesystem path, surfaces candidates a general review skips past. Treat the output as leads only: reproduce each one by hand, confirm the value is guessable from outside the system, then write a regression test that fails the moment the identifier stops being random. Budget time for that verification — it is where teams quietly lose the gains.

Where to start

Patch the internet-facing instance first, then the standbys, then confirm the build from outside the network. If you want a second pair of hands on the exposure inventory or the log review afterwards, start here and we will scope it with you — the Maysan Labs team would rather see your appliance patched this week than see the budget spent elsewhere.