Loading vulnerability…
Predictable File Upload Locations in Ivanti Connect Secure
CVE-2026-118527 is a predictable-identifier vulnerability in Ivanti Connect Secure that allows a remote authenticated attacker to upload files containing attacker-controlled content to a known disk location. Affected releases include 25.1.1.2 and earlier in the 25.1.1 branch and 22.8R2.5 and earlier in the 22.8 branch. The upload handler derives the temporary destination from the MD5 hash of the supplied filename and writes the uploaded content before validating it and deleting invalid archives. This predictable placement was exploited with parallel requests and authentication bypass CVE-2026-104935 to execute uploaded content before deletion. Attackers also chained privilege escalation CVE-2026-111357 to obtain root-level command execution. The vulnerability has a reported CVSS score of 4.3 and was added to CISA's Known Exploited Vulnerabilities catalog on October 30, 2026.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The direct impact is unauthorized placement of attacker-controlled file content at a predictable location on the appliance. This vulnerability alone does not establish arbitrary-path writes, file overwrite, root access, or code execution. In the observed three-vulnerability chain, predictable upload placement enabled execution of a temporary payload, followed by root-level compromise. Resulting activity included credential theft, data exfiltration, authentication-traffic capture, and Active Directory reconnaissance. Queries targeted Windows LAPS passwords and BitLocker recovery information, but successful acquisition or use of those particular secrets was not established.
If you can’t patch tonight, do this now.
No vendor-specified interim workaround is identified. Investigate potentially exposed appliances using network and memory forensics, preserving memory and logs before rebooting or resetting where feasible. A clean Ivanti Integrity Checker Tool result does not exclude compromise. Review downstream identity activity for credential misuse, unusual LDAP queries, Kerberos credential testing, and password spraying originating from the appliance; patching alone does not eliminate previously stolen credentials or downstream access.
Patch, then assume compromise.
Upgrade affected 25.1.1 installations to 25.1.1.3 or later and affected 22.8 installations to 22.8R2.6 or later. For affected 25.1.2 deployments, follow Ivanti's branch-specific migration guidance to 25.1.3.1 or an appropriate later fixed release. Versions 25.1.1.2 and 22.8R2.5 address the earlier authentication bypass but do not fix this vulnerability. If compromise is suspected, preserve evidence where feasible, follow Ivanti's recovery procedures to factory-reset physical appliances or rebuild virtual and cloud instances, install a fixed release, and rotate potentially exposed passwords, certificates, API keys, and other stored credentials.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
98 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.