What happened
A critical vulnerability has been identified in Ivanti Connect Secure, which allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This weakness stems from a generation of predictable numbers or identifiers within the product, enabling exploitation. The vulnerability has been actively exploited in the wild, indicating that malicious actors are currently leveraging this flaw to compromise affected systems. The issue is associated with CWE-340, highlighting improper weakness mitigation that can lead to security breaches. The vulnerability, designated as CVE-2026-118527, presents significant risks due to its potential for remote code execution and unauthorized access, especially when combined with related vulnerabilities CVE-2026-104935 and CVE-2026-111357.
Who is affected
Organisations running Ivanti Connect Secure are potentially impacted by this vulnerability. Affected deployments include those where the product is accessible over the internet, particularly in environments where proper segmentation and controls are not in place. Systems with active authentication mechanisms are at increased risk, as the exploit requires authentication to successfully upload malicious files. Active exploitation in the wild underscores the importance of swift mitigation measures to reduce exposure and prevent further compromise.
Recommended actions
- Apply mitigations in accordance with vendor instructions, ensuring compliance with the guidance outlined in CISA’s BOD 26-04 relating to prioritising security updates based on risk, as well as adhering to CISA’s “Forensics Triage Requirements.”
- Follow applicable BOD 26-04 guidance for cloud services or consider discontinuing the use of the product if mitigation options are unavailable, particularly in internet-exposed environments.
- Evaluate and manage internet accessibility for affected deployments, restricting unauthorised external access where feasible.
- Monitor for signs of compromise related to this vulnerability and perform appropriate forensic analyses if indicators of compromise are detected.
