TechPulse
CVE-2026-118527 MEDIUM · CVSS 4.3 (CVSS 3.1, Ivanti) · Ivanti — Ivanti Connect Secure (ICS) VPN ·

CVE-2026-118527: File upload handling with predictable on-disk identifiers

Low on its own, but a working link in an actively exploited chain: an authenticated attacker can upload attacker-controlled content to a predictable path on disk. Added to CISA KEV on Oct 30, 2026 (federal deadline Nov 13).

Identifier
CVE-2026-118527
Vendor / Product
Ivanti · Ivanti Connect Secure (ICS) VPN
Severity / CVSS
MEDIUM · CVSS 4.3 (CVSS 3.1, Ivanti)
Vector / CWE
CWE-340 (Generation of Predictable Numbers or Identifiers)
Network, authenticated; upload attacker-controlled content to a disk location known in advance; exploited as part of the UTA0576 chain
Affected
ICS 22.8Rx before 22.8R2.6, 25.1.1.x before 25.1.1.3, 25.1.2.x before 25.1.3.1 (25.1.3.x not affected)
Patched Version
ICS 22.8R2.6, 25.1.1.3, 25.1.3.1
Priority
P0 — Actively Exploited as a Chain Component; Patch With CVE-2026-111357

Executive Summary & Technical Impact

Low on its own, but a working link in an actively exploited chain: an authenticated attacker can upload attacker-controlled content to a predictable path on disk. Added to CISA KEV on Oct 30, 2026 (federal deadline Nov 13).

Tracked under CVE-2026-118527 (CWE-340 (Generation of Predictable Numbers or Identifiers)), this vulnerability affects ICS 22.8Rx before 22.8R2.6, 25.1.1.x before 25.1.1.3, 25.1.2.x before 25.1.3.1 (25.1.3.x not affected) and carries a severity score of 4.3 (CVSS 3.1, Ivanti) (MEDIUM). Engineering and security operations teams running Ivanti Connect Secure (ICS) VPN should prioritize upgrading to ICS 22.8R2.6, 25.1.1.3, 25.1.3.1.

Remediation & Patch Guidance

  1. Upgrade to ICS 22.8R2.6, 25.1.1.3 or 25.1.3.1.
  2. Treat it as part of the CVE-2026-104935 / CVE-2026-111357 chain: hunt for the same welcome.cgi and X-DSCGI-PATH indicators.

Frequently Asked Questions (CVE-2026-118527)

What versions are affected by CVE-2026-118527?

CVE-2026-118527 affects ICS 22.8Rx before 22.8R2.6, 25.1.1.x before 25.1.1.3, 25.1.2.x before 25.1.3.1 (25.1.3.x not affected) in Ivanti Connect Secure (ICS) VPN (File upload handling with predictable on-disk identifiers).

How do I patch or remediate CVE-2026-118527?

Upgrade affected deployments to ICS 22.8R2.6, 25.1.1.3, 25.1.3.1 and verify the remediation steps listed above.

What is the CVSS score of CVE-2026-118527?

CVE-2026-118527 is rated MEDIUM with a CVSS score of 4.3 (CVSS 3.1, Ivanti) (vector: Network, authenticated; upload attacker-controlled content to a disk location known in advance; exploited as part of the UTA0576 chain).

Full TechPulse Investigation

Ivanti Connect Secure: The Last Two Zero-Days in an Unauthenticated Root Chain Are Now Patched (CVE-2026-111357, CVE-2026-118527)

Ivanti's October 13 fix closed the front door, but not the privilege escalation attackers chained behind it. If you upgraded to 25.1.1.2 or 22.8R2.5 last month, you have to upgrade again.

Read full engineering post-mortem (6 min read) →

Official Vendor & NVD Advisory Links

  1. Ivanti Security Advisory (CVE-2026-104935, updated Oct 29)
  2. Volexity: Chained Exploitation of Ivanti Connect Secure Zero-Days
  3. CISA KEV additions (Oct 30, 2026)
  4. CERT-FR CERTFR-2026-ALE-013

Other Active Runtime & Infrastructure CVEs

View All in CVE Index →
CVE-2026-97229 CI/CD regular expression compiler (Ruby Onigmo regex engine) CRITICAL · 10.0 (CVSS 3.1, GitLab) CVE-2026-112816 Remote API mutual-TLS client authentication (certificate chain matching) CRITICAL · 10.0 (CVSS 4.0, Canonical) CVE-2026-116241 Import/Export Data tool (psql \copy query-export guard) CRITICAL · 9.9 (CVSS 3.1, PostgreSQL CNA) CVE-2026-98432 IPv4 request-socket options (inet_opt / ireq_opt) in tcp_v4_syn_recv_sock and request-socket migration CRITICAL · 9.8 (CVSS 3.1, Linux kernel CNA) CVE-2026-110186 Code generation service (reachable through MCP tool enumeration) CRITICAL · 9.8 (CVSS 3.1, IBM) CVE-2026-93680 Auto-login security control CRITICAL · 9.8 (CVSS 3.1, IBM)