Zero Radar
← feed
CriticalVulnerabilityCVE-2026-118527updated 30 Oct 2026, 17:59 UTC

Ivanti Connect Secure lets logged-in attackers upload files they control

Attackers who already have a login to Ivanti Connect Secure, a remote-access VPN gateway, can upload files of their choosing to a predictable place on the server. Attackers are actively using this flaw.

Exploited (CISA KEV)Official, 2 sources
SeverityCriticalVulnerability
Being exploited?YesConfirmed by CISA KEV · 30 Oct 2026
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker logs inNeeds valid remote-access credentials
  2. 2Uploads crafted fileGoes to a predictable location on disk
  3. 3Chains with other flawsCombined with CVE-2026-104935 and CVE-2026-111357
  4. 4Gateway compromisedAttacker gains footing on the VPN server
  5. ResultAttacker gains control of VPN gateway

What happened

Ivanti Connect Secure contains a generation of predictable numbers or identifiers flaw that lets a remote authenticated attacker upload attacker-controlled files to a known location on disk. It can be chained with CVE-2026-104935 and CVE-2026-111357.

Why it is dangerous: Being able to plant files on an internet-facing VPN server can let attackers take further control of it, and chaining with other flaws raises the risk. Organizations running exposed Ivanti gateways are at risk.

Are you affected?

You are affected if you run Ivanti Connect Secure on an internet-exposed server and an attacker can obtain or already holds valid credentials.

Ivanti Connect Secure (exact versions not stated in the provided material)

What to do

  1. Check whether your Ivanti Connect Secure appliances are reachable from the internet and inventory them.
  2. Apply the mitigations or patches from Ivanti's vendor instructions as soon as possible.
  3. Review the appliance for signs of compromise following CISA's forensics triage requirements.
  4. If no mitigation is available, discontinue use of the product until one is.

Timeline

  1. 30 Oct 2026, 00:00 UTC
    Publicly disclosed
  2. 30 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 30 Oct 2026, 17:49 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 17:59 UTC
    CISA reported on it · CISA

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118527
Disclosed
30 Oct 2026, 00:00 UTC
On Zero Radar
30 Oct 2026, 17:49 UTC (18 h after disclosure)
Last change
30 Oct 2026, 17:59 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Ivanti Connect Secure lets logged-in attackers upload files they control · Zero Radar