CISA Adds Exploited Ivanti Connect Secure Flaw to KEV Catalogue

CISA added CVE-2026-118527 to its Known Exploited Vulnerabilities (KEV) catalogue on 30 October 2026. The vulnerability affects Ivanti Connect Secure and allows a remote authenticated attacker to upload files containing attacker-controlled content to a known location on disk.

The flaw, named the Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability, concerns the generation of predictable numbers or identifiers. It can be chained with CVE-2026-104935 and CVE-2026-111357. The available data does not provide a CVSS score, and patch status is unknown. CISA’s entry directs organisations to apply mitigations in accordance with Ivanti’s instructions; it does not confirm whether a patch is available.

CISA’s KEV listing indicates that the vulnerability has been exploited in the wild. Use in ransomware campaigns is unknown. CISA set 13 November 2026 as the remediation deadline.

CISA requires affected Federal Civilian Executive Branch (FCEB) agencies to apply mitigations in accordance with vendor instructions, complying with BOD 26-04 guidance on prioritising security updates and CISA’s Forensics Triage Requirements. For cloud services, agencies should follow applicable BOD 26-04 guidance; if mitigations are unavailable, they should discontinue use of the product. Stakeholders must evaluate each asset’s internet exposure and adhere to BOD 26-04 patching guidance. All organisations should review their exposure and consult Ivanti’s instructions.

See the [NVD entry](https://nvd.nist[.]gov/vuln/detail/CVE-2026-118527) and [CISA KEV catalogue](https://www.cisa[.]gov/known-exploited-vulnerabilities-catalog) for full details.