CVE-2026-118527
MEDIUM
Actively Exploited
ivanti
connect_secure
NVDCISA KEV
CVSS Score
4.3
Severity
MEDIUM
Published
Nov 03, 2026
Vendor
ivanti
This vulnerability is in the CISA Known Exploited Vulnerabilities Catalog. Active exploitation has been observed. Immediate patching is recommended.
Description
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.