{"id":"CVE-2026-118527","title":"Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.","summary":"Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-340"],"vendor":"Ivanti","product":"Connect Secure","affected":["connect_secure (all versions)"],"ssvc":{"exploitation":"active","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-03T15:32:15.250213Z"},"exploited":true,"exploitAvailable":true,"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T15:32:56.011Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118527","references":[{"url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US"}],"tags":["cve.org","in-the-wild","exploit-available","kev"],"epss":0.00822,"epssPercentile":0.57429,"kev":true,"kevDateAdded":"2026-10-30","kevDueDate":"2026-11-13","kevRansomware":false,"zeroDay":true,"ingestedAt":"2026-11-05T19:30:42.987Z","slug":"CVE-2026-118527","body":"## Overview\n\nUse of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.\n\n## Affected\n\n- `connect_secure (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":49,"depthScoreParts":{"impact":23.7,"likelihood":0.2,"exploitation":25,"ransomware":0},"changes":[]}