Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
CVE-2026-118527
CVSS base score
4.3 (v3.1)
Severity
MEDIUM
Attack vector
Network
Weakness
CWE-340
Last modified
November 3, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
ivanti connect secure
References
- hub.ivanti.com Vendor Advisory
- www.cisa.gov US Government Resource