Ivanti Connect Secure CVE-2026-118527

Requires valid authentication to the Ivanti Connect Secure appliance (CVSS PR:L) reached over the network (AV:N); it is not a pre-auth flaw, so a low-privilege account or session is the key prerequisite and the main limiting factor. The weakness is the product's use of predictable filenames (CWE-340), which lets the authenticated user write attacker-controlled content to a deterministic, known on-disk location. Affected deployments are Ivanti Connect Secure before 25.1.1.3 and before 22.8R2.6; patched builds are not vulnerable. The specific feature or endpoint that performs the upload, and the exact trigger, are not described in the available sources.

The input CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) describes a low-severity, integrity-only flaw: a remote but authenticated (PR:L) attacker can write attacker-controlled content to a predictable disk location, with no confidentiality (C:N) or availability (A:N) impact. On raw CVSS this reads as a minor issue. However, CISA KEV status is YES (confirmed actively exploited), which sharply elevates real-world priority and contrasts with the modest base score. This pattern - a low-scoring, authenticated file-write primitive that is nonetheless on KEV - strongly suggests it is being used as a chaining primitive (write-to-known-location enabling a follow-on flaw) rather than as a standalone high-impact bug; Ivanti Connect Secure has a documented history of exploit chains. No EPSS score is provided and no POC/exploit reference is given, so exploitation probability cannot be quantified from the input. There is also signal tension: KEV indicates active exploitation while the vuln.today Decision label is 'this_month' (not act_now/emergency), so treat this as prioritized remediation within the month per the decision framework, weighted up by the confirmed in-the-wild use. No SSVC automatable/technical-impact fields were supplied.

A remote attacker who already holds valid credentials (or a low-privilege session) on an Ivanti Connect Secure appliance predicts the filename and known on-disk location used by the product and uploads a file with attacker-chosen content there. Because the location is deterministic, the planted file can be reliably targeted and likely used to stage a follow-on step. No public exploit code is referenced in the input, but the flaw is confirmed actively exploited (CISA KEV).