Vulnerability intelligence

CVE-2026-118527: Ivanti Connect Secure predictable filenames

A defensive advisory on Ivanti Connect Secure CVE-2026-118527, affected versions, CVSS 4.3, the CISA KEV listing and safe remediation.

IRIROSG Editorial·2026-11-03·1 min read·84 body words

CVE-2026-118527: Ivanti Connect Secure predictable filenames

IdentifierCVE-2026-118527

Vendor / productIvanti / Ivanti Connect Secure

Severity scoreCVSS 4.3

Added to CISA KEV2026-10-30

A KEV listing indicates evidence of real-world exploitation—not that every installation is compromised. Check your version, configuration and the vendor’s advisory.

CVE-2026-118527 is a predictable-filename weakness in Ivanti Connect Secure that can allow a remote authenticated attacker to upload attacker-controlled content to a known disk location. The independent CVSS 3.1 score is 4.3 Medium, but CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 30, 2026. This advisory explains the affected version branches, vendor guidance, the potential for chains with other issues and defensive triage. The full analysis is available in Persian.

This is an English overview. The complete original article is currently published in Persian.

TRACEABLE KNOWLEDGE

Sources & further reading

NVD — CVE-2026-118527https://nvd.nist.gov/vuln/detail/CVE-2026-118527

CISA Known Exploited Vulnerabilities cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalog

Ivanti official security advisory for Connect Securehttps://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US

KISA/CERT formal vulnerability notificationhttps://www.krcert.or.kr/kr/bbs/view.do?bbsId=B0000133&menuNo=205020&nttId=72263

IROSG / EDITORIAL

News and pioneer profiles use original writing with source attribution. Image credits and licenses are kept in each page’s sources section instead of beneath the images. CVE reference data credits its primary sources.

Editorial and image policy ↗