Ivanti Connect Secure file upload exploited in the wild (CVE-2026-118527)

Actively exploited in the wild - CVE-2026-118527 is a medium-severity file upload vulnerability in Ivanti Connect Secure before 25.1.1.3 and 22.8R2.6 that lets a remote authenticated attacker write attacker-controlled content to a predictable location on disk. Patched builds are available; upgrade immediately.

Overview

Ivanti Connect Secure relies on filenames that an attacker can predict when handling certain uploads. Because the destination path is deterministic, an authenticated user does not need to guess where a file lands or trick the system into an unusual location. They simply upload crafted content, and it is written to a known directory on the appliance.

The CVSS score is 4.3, which reflects that the attacker must already hold valid low-privilege credentials and that no user interaction is required. The vector (AV:N/AC:L/PR:L/UI:N) means the attack runs entirely over the network with no complexity barrier once an account exists.

Despite the moderate score, CISA has added this CVE to its Known Exploited Vulnerabilities catalog. That is the decisive signal. Real-world exploitation is confirmed, and the score understates operational risk on internet-facing VPN appliances, which are high-value targets for initial access brokers.

Impact

A remote authenticated attacker can place files with attacker-controlled content at a known on-disk location. The direct consequence is content injection onto the appliance, and in the worst case that planted content can be combined with other weaknesses to extend an intrusion. The predictable-filename design removes guesswork, so a low-privileged account is enough to stage a payload reliably and repeatedly.

Because Connect Secure sits at the network edge and terminates remote-access sessions, compromise of the appliance can expose credentials, session material, and internal reachability. Any authenticated foothold on this class of device should be treated as a potential precursor to broader lateral movement.

Remediation and Mitigation

• Upgrade to Ivanti Connect Secure 25.1.1.3 or 22.8R2.6 (or later). These builds remove the predictable-filename weakness.
• Hunt for prior exploitation before patching. Review upload directories and file-write logs for unexpected content, and reconcile any unknown files against approved administrative activity.
• Enforce least privilege on accounts that can upload files, and audit for stale or over-privileged credentials.
• Rotate credentials and session tokens if compromise is suspected, and check for persistence or configuration tampering on the appliance.
• Restrict management and upload interfaces to trusted networks where the deployment allows it.

Given confirmed exploitation, treat patching as urgent even though the CVSS score is only 4.3. Organizations tracking edge-device compromises can review breach reports and follow security news for updates.

Security Insight

This CVE is a textbook example of a low CVSS score colliding with confirmed exploitation, and it shows why severity ratings alone are a poor triage signal for edge appliances. Predictable filenames sit in the same design family as path-traversal and insecure direct object reference bugs: the flaw looks minor until an attacker pairs it with one more primitive. Ivanti’s Connect Secure has now accumulated repeated exploit campaigns, which suggests the product’s security model deserves scrutiny beyond any single patch cycle. Defenders should shift budget toward detection on the appliance itself, not just version hygiene.

Further Reading

• All Medium Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs