# CVE-2026-118527

Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.

- Page: https://www.vulneraibility.com/cve/CVE-2026-118527
- CVSS: 4.3
- Known exploited: yes, in CISA KEV since 2026-10-30; CISA due date 2026-11-13
- EPSS: 0.82% (percentile 57.7)
- CISA SSVC: exploitation active, automatable no, technical impact partial (assessed 2026-11-03)
- Weakness: CWE-340
- Published: 2026-11-03

## Affected

- ivanti:connect_secure

## References

- [other] https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-118527

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.