CVE-2026-118527 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	4.3 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Affected Products (NVD)

Vendor	Product	Version
ivanti	connect_secure	25.1.0.0 ≤ 𝑥 < 25.1.1.3
ivanti	connect_secure	22.8:r2
ivanti	connect_secure	22.8:r2.1
ivanti	connect_secure	22.8:r2.2
ivanti	connect_secure	22.8:r2.3
ivanti	connect_secure	22.8:r2.4
ivanti	connect_secure	22.8:r2.5

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-340 - Generation of Predictable Numbers or Identifiers
The product uses a scheme that generates numbers or identifiers that are more predictable than required.

Vulnerability Media Exposure

[ENGLISH] Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. The vulnerabilities are listed below - CVE-2026-111357 (CVSS score: 8.8) - A missing authentication for a critical function vulnerability that could allow a
Published: 2026-10-31T13:57:43+05:30
[GERMAN] Attacken auf Lücken in Drupal, Ivanti Connect Secure und Synology laufen
Angreifer missbrauchen Lücken in veralteten Betriebssystemen oder als Zero-Day-Lücken in Drupal, Ivanti Connect Secure und Synology.
Published: 2026-11-02T07:45:00+00:00

References

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-118527