Predictable Identifier Vulnerability in Ivanti Connect Secure (CVE‑2026‑118527) Allows Authenticated File Upload
What It Is — Ivanti Connect Secure (the remote‑access gateway formerly known as Pulse Secure) contains a flaw where the system generates predictable numbers or identifiers for internal objects. An attacker who has valid credentials can exploit this weakness to upload files with attacker‑controlled content to a known location on the appliance’s filesystem. The issue can be chained with two other Ivanti CVEs (CVE‑2026‑104935 and CVE‑2026‑111357) to achieve deeper compromise. The vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and carries a CVSS v3.1 base score of 8.8 (High).
Affected Products – Ivanti Connect Secure (all supported versions at the time of disclosure).
Why It Matters for Trust & Control Assurance – The flaw demonstrates a gap in access‑control enforcement for file‑upload functions, a control area that underpins many compliance frameworks (e.g., NIST CSF Identify‑Protect).
Recommended Actions –
- Apply Ivanti’s security patch for CVE‑2026‑118527 immediately.
- Enforce least‑privilege for accounts that can access the portal; disable unnecessary upload capabilities.
- Enable and review detailed file‑upload and authentication logs for anomalous activity.
- Conduct a rapid control‑mapping review to confirm that file‑handling controls are documented and auditable.
Source: CISA KEV – CVE‑2026‑118527