Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability (CVE-2026-118527)

What is affected, what to do

Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Apply the vendor fix: a patch is available from the vendor; look up the fixed version in the Ivanti security advisory for CVE-2026-118527. This flaw chains with CVE-2026-104935 and CVE-2026-111357, so deploy a release that remediates all three. A partial fix leaves the exploit chain intact.
   • Check for compromise before and after patching: run the Ivanti External Integrity Checker Tool (ICT) matching your release. If it reports any mismatch, treat the appliance as compromised. Factory-reset it, reinstall on a patched image, and restore configuration only from a verified backup.
   • Lock down the admin interface: the management UI must not be reachable from the internet on TCP/443. Restrict it to a dedicated management interface or VLAN with a jump-host allowlist.
   • Rotate credentials: the attacker needs to be authenticated, so reset local admin accounts, the LDAP/AD bind service accounts, RADIUS shared secrets, and API tokens. If compromise is suspected, also terminate all active VPN sessions and reissue the appliance TLS certificate.
   • Preserve evidence: export the event, user-access, and admin-access logs and the syslog feeds before any reset. Store them tamper-proof to keep forensic evidence intact and to support NIS2 reporting.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: place the Connect Secure appliance in a dedicated DMZ zone. Restrict its egress to an allowlist: auth servers, NTP, DNS, syslog, and Ivanti update servers. This disrupts reverse shells and second-stage tooling delivered through the chain.
   • Authentication hardening: enforce MFA on every user and admin realm. Disable local accounts without MFA and retire realms with weak password policies. This raises the bar for obtaining the authenticated foothold the bug requires.
   • Least privilege: trim roles that grant upload or file-management rights to the minimum needed. Disable unused features such as portal file sharing and unused realms or sign-in URLs.
   • WAF/IPS in front of the appliance: enable vendor IPS/NGFW signatures covering the Ivanti chain. Add a custom rule for anomalous multipart/form-data POSTs, in size or frequency, to /dana-na/ and /dana-ws/ paths, especially from freshly established sessions.
   • External integrity monitoring: schedule ICT runs, for example daily until the patch rollout is complete. Version configuration snapshots so that drift is easy to spot.
3. 03

   Runbook step 3

   Detection rules

   • Requests for dropped artefacts (proxy/WAF/appliance access logs): flag requests for unusual extensions or never-before-seen file names under the web root. Pay particular attention when they follow an authenticated upload from the same source IP. Sigma shape: cs-method=GET AND uri|re='\.(cgi|pl|py|sh|php)$' AND NOT uri IN known_baseline.
   • Login → upload → fetch sequence: correlate the same user or source IP across these three steps within a few minutes to catch chain exploitation. Example SPL: index=ivanti (msg="Login succeeded" OR method=POST OR method=GET) | transaction src_ip maxspan=10m | where eventcount>20.
   • Network telemetry (Zeek/Suricata): alert on new outbound connections from the appliance IP to non-allowlisted destinations, such as odd ports or cloud-hosting ASNs. Example KQL: CommonSecurityLog | where SourceIP == "<ICS-IP>" and DestinationIP !in (allowlist) | summarize count() by DestinationIP, DestinationPort.
   • Admin and configuration events: watch for unexpected admin logins, new local accounts, modified roles or realms, and cleared logs or gaps in the appliance's syslog stream. Alert when syslog from the appliance goes silent for more than 15 minutes.
   • ICT findings: treat any ICT report of new or modified files as a critical incident, never as a configuration nuisance.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.

Source: pwn.watch, HKCERT (CC BY 3.0 HK) · HKCERT rating: high, CISA KEV Catalog

References & sources

• pwn.watchpwn.watch: Ivanti Connect Secure zero-day chain (CVE-2026-104935) exploited for rootpwn-watch
• thestack.technologyIvanti patches two more CVEs amid highly unusual Connect Secure exploitationpwn-watch
• securityonline.infoIvanti Connect Secure Vulnerability Exploited in the Wildpwn-watch
• cisa.govCISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2026-111357)pwn-watch
• volexity.comVolexity: Chained Exploitation of Ivanti Connect Secure Zero-Dayspwn-watch
• ivanti.comIvanti October 2026 Security Updatepwn-watch
• bleepingcomputer.comBleepingComputer: Ivanti warns of Connect Secure zero-daypwn-watch
• rapid7.comIvanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)pwn-watch
• dbu.gsSale of a PoC for a vulnerability in Ivanti Connect Secure (CVE-2026-104935)pwn-watch
• cisa.govCISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2026-111357, CVE-2026-118527)pwn-watch

Linked advisories

• Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainSecurityWeek02.11.2026