Ivanti Connect Secure Vulnerability CVE-2026-118527

Catalog analysis: CISA added this entry on October 30, 2026. The entry reflects catalog information retrieved on October 30, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-118527 is a vulnerability in Ivanti Connect Secure involving the generation of predictable numbers or identifiers (CWE-340). This flaw allows a remote attacker who has already been authenticated to upload files containing attacker-controlled content to a known location on the system’s disk.

Of particular concern for security teams is that this vulnerability does not act in isolation; it can be chained with two other vulnerabilities, CVE-2026-104935 and CVE-2026-111357, to potentially increase the impact of the attack.

Exposure and applicability

This vulnerability applies to organizations utilizing Ivanti Connect Secure for remote access. In a healthcare context, these gateways often serve as the primary entry point for clinicians, administrators, and business associates accessing internal networks containing electronic Protected Health Information (ePHI).

Because the flaw requires authentication, the immediate risk is highest in environments where account security is weak or where an attacker has already gained initial credentials. However, the ability to upload files to a known disk location provides a foothold that could be used to further compromise the appliance and, by extension, the healthcare network it protects.

Remediation priorities

Our analysis suggests that healthcare IT and security leaders prioritize the following actions based on the risk to operational resilience:

1. Immediate Patching/Mitigation: Follow vendor-provided instructions to apply updates or mitigations for CVE-2026-118527. Given its inclusion in CISA’s Known Exploited Vulnerabilities catalog, this should be treated as a high-priority event.
2. Chain Analysis: Ensure that remediations also address CVE-2026-104935 and CVE-2026-111357, as the risk is compounded when these vulnerabilities are chained together.
3. Credential Audit: Since the vulnerability requires authentication, security teams should review access logs for anomalous authenticated activity on the Connect Secure appliance.

How to validate remediation

To verify that exposure has been reduced, administrators should:
* Verify Versioning: Confirm that the installed version of Ivanti Connect Secure matches the patched versions specified in the vendor’s official security advisory.
* Configuration Review: If mitigations were applied instead of a full patch, verify through the management console that the specific configuration changes recommended by the vendor are active.

Note that while these steps confirm the application of a fix, they do not guarantee that the system is entirely secure or that no prior compromise has occurred.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in ransomware campaigns. Additionally, while CISA has set a remediation deadline for federal agencies (2026-11-13), this date is a regulatory requirement for those specific entities and not a universal technical deadline for private healthcare providers.

There is residual risk if an attacker had already leveraged the vulnerability to place files on the disk prior to patching. Organizations should refer to vendor guidance regarding forensic triage to determine if their specific environment was targeted before the mitigations were applied.

Source and editorial note

CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability · Source date: October 30, 2026 · Retrieved October 30, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a healthcare security assessment