CVE-2026-118527 · Ivanti Connect Secure generation of predictable identifiers file…

01 · The Real Story

A ride-share car where knowing the license plate lets any passenger put a bag in the trunk—and the attackers already stole the driver's account.

CVE-2026-118527 is a generation of predictable numbers or identifiers flaw in Ivanti Connect Secure (ICS). A remote authenticated attacker can upload files with attacker-controlled content to a known location on disk. Affected versions are 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior. On its own it is a low-severity primitive (CVSS 4.3), but in the wild it is chained with CVE-2026-104935 (authentication bypass) and CVE-2026-111357 (local privilege escalation) to achieve full unauthenticated root-level code execution.

The vendor/CNA severity of 4.3 (MEDIUM) does not match reality. That score treats the flaw as an authenticated, low-integrity upload primitive without accounting for the chain. CISA added this CVE to its Known Exploited Vulnerabilities catalog on October 30, 2026, confirming exploitation by threat actor UTA0576. Once chained, attackers gain root on an internet-facing VPN gateway, enabling credential theft, data exfiltration, and lateral movement into the internal network. In a perimeter device, this is a CRITICAL exposure.

"Ivanti Connect Secure chains this predictable file upload with auth bypass and local priv esc into unauthenticated root—patch now."

02 · The Attack Path

4 steps from start to impact.

STEP 01

Exploit authentication bypass (CVE-2026-104935)

The attacker targets an internet-exposed Ivanti Connect Secure appliance and exploits the authentication bypass vulnerability to obtain an authenticated session without valid credentials. This step is the entry point for the UTA0576 campaign and is being actively exploited in the wild.

Conditions required:

Targeted ICS is reachable from the internet
Vulnerable version of ICS (pre-patch 25.1.1.3 / 25.1.2.3 / 22.8R2.6)

Where this breaks in practice:

Not all ICS are internet-exposed, but remote-access gateways typically are
Ivanti shipped mitigations on Oct 13, but many appliances remained unpatched

Detection/coverage: CISA KEV alerts, Ivanti Integrity Checker Tool, external port scans, GreyNoise tracking of ICS exploit attempts

STEP 02

Upload attacker-controlled file to predictable location (CVE-2026-118527)

Using the authenticated session obtained in step 1, the attacker exploits CVE-2026-118527 to upload a malicious file to a known, predictable path on the ICS filesystem. Because the identifier generation is predictable, the attacker can choose the exact landing spot for later execution.

Conditions required:

Authenticated (or bypassed) session on the target ICS
Knowledge of the predictable identifier scheme (documented in advisory/exploit chain)

Where this breaks in practice:

As a standalone flaw it requires authentication, but the auth bypass removes that barrier
The exploit chain includes this step as a primitive; no public standalone PoC has been observed

Detection/coverage: File integrity monitoring on the appliance, ICS internal logging of uploads, host-based IDS on the ICS Linux filesystem

STEP 03

Achieve local privilege escalation to root (CVE-2026-111357)

The attacker exploits the third vulnerability to escalate privileges from the context of the uploaded file to root. This turns a mere file upload into arbitrary code execution with full control of the appliance.

Conditions required:

Uploaded file must be in a location that can be executed in a privileged context
Vulnerable local privilege escalation path present in ICS

Where this breaks in practice:

Local step requires access to the appliance, which the previous remote steps already provide
Once root is achieved, all subsequent defenses on the appliance are moot

Detection/coverage: EDR-like agents on ICS (if present), privilege escalation auditing, SE Linux or AppArmor profiles (usually not enabled by default on ICS)

STEP 04

Harvest credentials and move laterally

With root on the ICS, the attacker extracts cached VPN credentials, session tokens, and possibly certificate material. They then pivot into the corporate network, establish persistence, and exfiltrate data. This is the documented outcome in CISA and Volexity reporting.

Conditions required:

Root shell on ICS
Active user sessions or stored credentials on the appliance

Where this breaks in practice:

No further friction once root is achieved; credential stores and network reachability are inherent to the role
The appliance typically terminates VPN connections, giving direct access to internal segments

Detection/coverage: SIEM correlation of anomalous ICS logins, network traffic analysis for lateral movement, credential store access logs

03 · Compensating Control

CRITICAL 9.8→IGNORE 0.0

SEVERITY REDUCED

Apply the vendor patch immediately (25.1.1.3 / 25.1.2.3 / 22.8R2.6) — Deploy the Ivanti patch within 3 days per noisgate mitigation SLA for CRITICAL, and complete fleet-wide remediation within 90 days. Patching breaks the chain at every step and is the only definitive fix.

CRITICAL 9.8→MEDIUM 5.0

SEVERITY REDUCED

Restrict external access to ICS admin plane and enforce strict network segmentation — If patching must be delayed, restrict the management interface to trusted IPs or an internal jump host, and place the appliance behind a VPN/bastion. This degrades the remote unauthenticated entry point. Deploy within 3 days.

CRITICAL 9.8→CRITICAL 9.8

Run Ivanti Integrity Checker Tool and hunt for post-exploitation IOCs — Immediately scan all ICS appliances for signs of compromise. Detect uploaded files in known locations and root-level persistence artifacts. This does not close the vulnerability but enables containment.

What doesn't work

Enabling MFA alone does not stop the chain, because the initial auth bypass defeats the credential check entirely.
Generic WAF rules are unlikely to block the predictable-identifier upload unless explicitly tuned to the ICS upload endpoints and identifier scheme.
Monitoring CVSS 4.3 as a low-priority patch item is dangerous; the KEV listing and active chain override the standalone score.

04 · Intelligence Metadata

The supporting signals.

In-the-wild status	Actively exploited. CISA KEV added 2026-10-30; Volexity tracks the campaign as UTA0576 chaining this CVE with CVE-2026-104935 (auth bypass) and CVE-2026-111357 (local EoP) for unauthenticated root.
Proof-of-concept availability	No public standalone PoC for CVE-2026-118527 has been identified; exploitation is occurring via a private chain used by UTA0576. Public descriptions of the chain exist in CISA and ThaiCERT advisories.
EPSS score	Not available in returned data; KEV listing and active exploitation supersede EPSS as the priority signal.
KEV status	Listed: Date added 2026-10-30, due date 2026-11-13. CISA notes `CWE-340` and “Known To Be Used in Ransomware Campaigns? Unknown”.
CVSS vector	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N` = 4.3. This vector ignores the chain and the perimeter role; effective severity is CRITICAL.
Affected versions	Ivanti Connect Secure 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior.
Fixed versions	25.1.1.3, 25.1.2.3, and 22.8R2.6 (Ivanti advisory via Belgian CCB and CISA).
Scanning/exposure data	ICS is an internet-facing SSL VPN appliance; active exploitation is being tracked by CISA. No specific Shodan/Censys counts in the provided sources, but the device class is routinely exposed and scanned.
Disclosure date	Ivanti advisory initially Oct 13, 2026 for CVE-2026-104935; CVE-2026-111357 and CVE-2026-118527 added Oct 29–30, 2026.
Researcher/org	Volexity tracked the chain as UTA0576; Ivanti and CISA coordinated disclosure. ThaiCERT, CERT.UG, and Belgian CCB published alerts.

Sources.

05 · The Call

Final Verdict

↑ UPGRADED to CRITICAL (9.8/10)

Why this verdict

KEV active exploitation: CISA added CVE-2026-118527 to KEV on 2026-10-30, confirming exploitation by UTA0576 in a chain that leads to unauthenticated root. This is not theoretical.
High-value edge role: ICS is a perimeter SSL VPN and remote-access gateway. Root on this device yields credential theft, data exfiltration, and a pivot into the internal network.
Role multiplier: Ivanti Connect Secure is canonically internet-facing. The documented chain succeeds in the high-value role, and the outcome is domain/fleet-scale access. Verdict floor is CRITICAL.
Friction audit: Initial access is remote and unauthenticated via CVE-2026-104935; the predictable-upload step only requires the session, which the bypass provides. No local or physical prerequisite blocks the chain.

Why not higher?

The vulnerability by itself is not a remote code execution primitive and requires chaining with two other CVEs to achieve root. There is no evidence of autonomous worming or ransomware deployment directly attributed to this CVE alone. A patch is available and the chain is well-described, so rapid remediation is possible.

Why not lower?

The standalone CVSS of 4.3 is misleading because it ignores the active chain and the perimeter role. KEV listing, confirmed in-the-wild exploitation, and the ease with which the auth bypass removes the authentication prerequisite make a MEDIUM or HIGH verdict unjustifiable. Once root is achieved on a remote-access appliance, the blast radius is domain-level.

06 · Verification

Crowdsourced verification payload.

Run on the Ivanti Connect Secure appliance as root or via the admin shell. Save the script as check_cve-2026-118527.sh, then execute bash check_cve-2026-118527.sh. Outputs VULNERABLE, PATCHED, or UNKNOWN.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/bin/bash
# Check ICS version against CVE-2026-118527 fixed versions
ver=""
for f in /home/version /home/etc/pulse/version /etc/ivanti-release /etc/issue; do
  if [ -f "$f" ]; then
    ver=$(grep -Eo '[0-9]+(\.[0-9]+)+(R[0-9]+)?' "$f" | head -1)
    [ -n "$ver" ] && break
  fi
done
if [ -z "$ver" ]; then
  echo UNKNOWN
  exit 3
fi
# Parse major.minor[.R] and compare with known fixed versions
fixed1="25.1.1.3"
fixed2="25.1.2.3"
fixed3="22.8R2.6"
ver_cmp="$ver"
# Normalize 22.8R2.6 to 22.8.2.6 for comparison
case "$ver_cmp" in 22.8R*) ver_cmp=$(echo "$ver_cmp" | sed 's/R/./');; esac
case "$fixed3" in 22.8R*) fixed3c=$(echo "$fixed3" | sed 's/R/./');; esac
if [ "$(printf '%s\n%s' "$ver_cmp" "$fixed1" | sort -V | head -1)" = "$ver_cmp" ] && [ "$ver_cmp" != "$fixed1" ]; then
  echo VULNERABLE
  exit 1
elif [ "$(printf '%s\n%s' "$ver_cmp" "$fixed2" | sort -V | head -1)" = "$ver_cmp" ] && [ "$ver_cmp" != "$fixed2" ]; then
  echo VULNERABLE
  exit 1
elif [ "$(printf '%s\n%s' "$ver_cmp" "$fixed3c" | sort -V | head -1)" = "$ver_cmp" ] && [ "$ver_cmp" != "$fixed3c" ]; then
  echo VULNERABLE
  exit 1
else
  echo PATCHED
  exit 0
fi