CVE-2026-118527
Ivanti Connect Secure flaw lets attackers exploit predictable identifiers in remote access gateways
The vulnerability is a generation of predictable numbers or identifiers in Ivanti Connect Secure, which remote access gateways use. Attackers have exploited it since at least October 1, often chaining it with another flaw. Ivanti released security updates on November 2, and CISA added the flaw to its known exploited vulnerabilities list on October 30.
Ivanti Connect Secure · Updated 2 Nov · From 1 of our story and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 30 Oct; US agencies must fix by 13 Nov
SeverityNot scoredNo score in the record yet
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- Apply Ivanti's security updates immediately, as CISA has directed federal agencies to remediate the flaw by November 13.
- If you use Ivanti Connect Secure, assume attackers may have already compromised affected gateways.
- Review CISA's known exploited vulnerability catalog entry and Ivanti's advisory for any additional mitigation steps.
What happened
- 1 OctThreat actors began exploiting the vulnerabilities in attacks chaining them together.
- 30 OctCISA added the two known exploited vulnerabilities to its catalog, requiring US federal agencies to fix them by November 13.
- 2 NovIvanti released security updates to patch the two zero-days, and multiple outlets reported on the exploits.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-118527 | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability | — | 30 Oct | — |
Our reporting
2 NovIvanti patches two more Connect Secure zero-days exploited since OctoberReported elsewhere
Help Net Security · 2 NovCISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) ↗Rapid7 · 2 NovAdditional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) ↗BleepingComputer · 2 NovIvanti patches two more Connect Secure zero-days chained in attacks ↗CISA · 30 OctCISA Adds Two Known Exploited Vulnerabilities to Catalog ↗The records
CISA known-exploited catalog ↗CVE-2026-118527 on NVD ↗Is anything you run affected?Connect Zotpaper to Claude, ChatGPT or Cursor and ask. It checks your project's packages against this vulnerability and every other one in the advisory databases, and says what to update. Your first 20 lookups are free.
Try it free