First published Oct 30, 2026, 5:16:15 PM UTC · Last updated Oct 30, 2026, 5:16:15 PM UTC

CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

Reported by CISA Known Exploited Vulnerabilities

The source describes a vulnerability that allows a remote authenticated attacker to upload attacker-controlled files to a known disk location and says it can be chained with two other CVEs. It directs stakeholders to apply vendor mitigations or discontinue use if mitigations are unavailable.

Share this event

Follow: Events in United States

Manage follows

Why it matters

The source calls for mitigation or discontinuing use when mitigations are unavailable.

Generated scores

Scores are based on the cited reporting and use a 1–10 scale. Read the methodology.

Confidence: 7/10How certain the assessment is based on the clarity and evidence in the cited reporting.
Geographic reach: 2/10How widely the event reaches, from a local area (1) to worldwide impact (10).
Global importance: 2/10The event's broader significance, from limited importance (1) to major global importance (10).
Impact magnitude: 2/10The scale or severity of the real-world impact, from minor (1) to extreme (10).
Urgency: 5/10How time-sensitive the event is, from low urgency (1) to immediate attention needed (10).

Primary official sources

CISA Known Exploited Vulnerabilities CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

Report an issue

Read our editorial process and corrections policy.

Continue exploring

Related developments reported in the last 30 days. These are not necessarily ongoing incidents.

Same topic
CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function VulnerabilityOct 30, 2026, 12:00 AM UTC
The excerpt describes an Ivanti Connect Secure vulnerability that could let a locally authenticated attacker escalate privileges, and directs stakeholders to apply vendor mitigations or discontinue use if mitigations are unavailable.
Same topic
CVE-2026-97229: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound VulnerabilityOct 29, 2026, 12:00 AM UTC
A vulnerability in GitLab Community Edition and Enterprise Edition could allow unauthenticated arbitrary code execution through a specially crafted regular expression in a CI/CD configuration. The source advises applying mitigations under applicable CISA guidance or discontinuing use if mitigation is unavailable.
Same topic
CVE-2026-41709: Broadcom VMWare ESX Insufficient Logging VulnerabilityOct 28, 2026, 12:00 AM UTC
The vulnerability could allow an actor with administrator access to perform certain operations without being logged. The source calls for applying vendor mitigations or discontinuing use if mitigations are unavailable.
Same topic
CVE-2026-46300: Linux Kernel Missing Initialization of a Variable VulnerabilityOct 28, 2026, 12:00 AM UTC
The source describes a Linux Kernel vulnerability that may permit in-place decryption of shared fragments and, when chained with two other CVEs, PHP webshell installation and root command execution. It calls for applying vendor mitigations and following CISA patching guidance.
Same topic
Warning Signals: Venezuela and the Risk of AI-Powered Chinese Digital AuthoritarianismOct 27, 2026, 9:10 PM UTC
An Australian think tank, ASPI, warns that Venezuela could integrate Chinese artificial intelligence into its surveillance system and expand digital control capabilities.
Same topic
NIST Report Provides Guidelines for Transition to Post-Quantum Cryptography StandardsOct 27, 2026, 12:00 PM UTC
The report describes timelines and migration activities for federal agencies. It is presented as a resource for technology providers and organizations developing quantum-readiness road maps.

Loading related developments…

Explore events in united states