CVE-2026-118527 Ivanti Connect Secure Vulnerability
CISA added two Ivanti Connect Secure flaws, CVE-2026-118527 and CVE-2026-111357, to its KEV catalog on 2026-10-30. Here is what they do and how to check your exposure.
Short answer: CVE-2026-118527 and CVE-2026-111357 in Ivanti Connect Secure are actively exploited and were added to CISA's KEV catalog on 2026-10-30. Apply Ivanti's mitigations, check whether your appliance is internet-facing, and run forensic triage. The 2026-11-13 date is CISA's deadline for US federal agencies; other organizations should treat it as a benchmark.
CISA added two Ivanti Connect Secure flaws, CVE-2026-118527 and CVE-2026-111357, to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-30. Treat them as actively exploited: apply Ivanti's mitigations now and check your appliances for signs of compromise.
What happened
The two bugs do different jobs, and attackers can chain them. CISA also names a third flaw, CVE-2026-104935, that can be chained with both.
CVE-2026-118527 is a generation of predictable numbers or identifiers vulnerability. A remote authenticated attacker can upload files with attacker-controlled content to a known location on disk.
CVE-2026-111357 is a missing authentication for critical function vulnerability. A local authenticated attacker can escalate their privileges.
In plain terms, one flaw lets a logged-in attacker plant a file where they know it will land. The other helps them gain higher privileges on the appliance. The details are on the NVD entry for CVE-2026-118527.
Who is affected
Anyone running Ivanti Connect Secure is in scope. Fixed version numbers are not confirmed yet, so check the Ivanti advisory and the NVD page for the exact list.
Your first move depends on how the appliance is exposed:
Your situation | First move |
|---|---|
Appliance reachable from the internet | Apply mitigations today, then run forensic triage |
Appliance only reachable on the internal network | Apply mitigations before the 2026-11-13 KEV due date and limit who can log in |
Not sure what you run | Inventory first, using the commands below |
Cloud-hosted service | Follow the BOD 26-04 guidance for cloud services |
Both flaws need an authenticated attacker. That makes stolen or weak VPN credentials part of the risk, not a side issue.
How serious it is
It is serious because it is exploited. CISA's KEV listing means exploitation has been observed. The KEV due date is 2026-11-13. That is the deadline CISA sets for US federal agencies. Other organizations should treat it as a benchmark, not a legal deadline.
Whether ransomware groups use these flaws is listed as unknown. Do not read that as safe. It only means CISA has no confirmed link.
The chain is what worries defenders. A file upload to a known path, plus a privilege escalation, may let an attacker with a valid account gain control of a VPN gateway. That device sits at the edge of your network and often holds access to everything behind it.
What to do now
CISA's required action is to apply mitigations in line with vendor instructions. It also points to its BOD 26-04 guidance on prioritizing security updates based on risk, and its "Forensics Triage Requirements." If mitigations are not available, CISA says to discontinue use of the product.
Find every Connect Secure appliance. Include test, lab and forgotten ones.
Open Ivanti's advisory and apply the listed mitigations or updates.
Record each asset's internet exposure. CISA says stakeholders are responsible for this evaluation.
Run forensic triage per CISA's requirements. Patching does not remove an attacker who is already in.
Reset credentials for accounts that use the VPN, starting with admins. Both bugs need a logged-in user.
Run the vendor's integrity checks if the advisory tells you to, and keep the output.
Check your exposure
From a machine outside your network, see whether the login page answers. Replace the hostname with yours.
curl -sI https://vpn.example.com/dana-na/auth/url_default/welcome.cgiTo find appliances in address space you own, scan for open HTTPS and read the banners. Only scan ranges you are allowed to test.
nmap -p 443 --open -sV 203.0.113.0/24After you export the appliance logs to a file, count the source IPs behind failed logins. A sudden spike from a few addresses deserves a closer look.
grep -Ei "login failed|authentication failed" ics-syslog.log | grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}' | sort | uniq -c | sort -rn | head -20Both flaws need a logged-in attacker, so successful logins matter too. List them by source IP and look for addresses you do not recognize.
grep -Ei "login succeeded|logged in" ics-syslog.log | grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}' | sort | uniq -c | sort -rn | head -20Adjust the search text to match your log format. These checks show exposure and noise. They do not prove you are clean.
A quick worked example
Say you manage three appliances. One is the main VPN, one is a disaster-recovery copy, and one is an old test box nobody remembers.
The scan finds that the main VPN and the test box answer from the internet. You mitigate the main VPN first, then retire or lock down the test box. The disaster-recovery copy gets the same mitigation, even though it is quiet. Attackers often find the forgotten device first.
The log check then shows a successful login to the test box from an address no one recognizes. That result moves the box from "clean up later" to "start forensic triage now."
What learners can take from it
This case teaches three habits that security exams and real jobs both reward. First, know that bugs that look limited on their own can be chained into serious attacks. Second, use the KEV catalog to decide what to fix first. Third, treat internet-facing edge devices as your highest-risk assets. If you are building these skills, our CompTIA Security+ study guide covers vulnerability management and incident response at a beginner-friendly level. For a similar edge-device case, see our post on the Cisco Secure Firewall ASA and FTD flaw.
Browse our cybersecurity certification vouchers when you are ready to book an exam.
Sources
Questions about this topic
Do I need to patch if my Connect Secure appliance is only used internally?
Yes, plan to. Both flaws need an authenticated attacker, and an internal user or a stolen internal account could still reach the appliance. Prioritize internet-facing devices first, then fix internal ones soon after.
Can attackers use CVE-2026-118527 without a login?
The NVD description says it needs a remote authenticated attacker. That means valid credentials are required. Stolen or reused VPN passwords therefore raise your risk, so reset them as part of your response.
Why does CISA mention forensic triage?
Because these flaws are already exploited, an unpatched appliance may have been compromised before you applied mitigations. CISA's Forensics Triage Requirements help you look for signs of that. Applying mitigations alone does not remove an attacker who is already inside.
What is CVE-2026-104935 and why is it mentioned?
CISA says CVE-2026-118527 and CVE-2026-111357 can each be chained with CVE-2026-104935. We have no further details on that flaw here, so check Ivanti's advisory for its status and fixes.
Is a vulnerability scanner enough to confirm I am safe?
No. A scanner can show that an appliance is exposed or running a vulnerable build. It cannot prove nobody used the flaws earlier. Pair it with log review and the vendor's integrity checks.