CVE-2026-118527

What is Ivanti Connect Secure?

Ivanti Connect Secure (ICS), formerly Pulse Connect Secure, is an SSL VPN appliance that terminates remote-access sessions for employees and contractors. It stands at the network edge with its web interface exposed to the internet, authenticates users against AD, LDAP, or SAML, and then hands them routed or clientless access to internal resources. Shadowserver tracks more than 5,500 internet-facing ICS instances. The appliance's web tier is a collection of CGI handlers, some pre-authentication and some post-authentication, and that split is exactly where the October 2026 attack chain lived. A defect in any one handler is worth little on its own; combined with a way to reach it without credentials, it becomes a foothold inside the perimeter.

Overview

CVE-2026-118527 is the middle link in the three-flaw chain that Volexity documented against ICS in October 2026, and the one that actually produces code execution. CISA describes it as a generation of predictable numbers or identifiers vulnerability allowing a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. The file upload handler wu.cgi names incoming files from a value the client controls, so the attacker knows in advance where the file will land, and the handler validates the file only after writing it.

On its own the flaw reads as minor: it needs authentication, and Ivanti rates it 4.3. Chained, it is the step that turns an authentication bypass into remote code execution. CVE-2026-104935 supplies unauthenticated reach into wu.cgi, this flaw supplies a known path to a file the attacker wrote, and CVE-2026-111357 lifts the resulting cgi-server shell to root. CISA assigned this entry a standard two-week BOD 26-04 deadline of 2026-11-13, longer than the three days given to CVE-2026-111357, which matches its lower standalone severity.

As of 2026-10-30 there is no published CVE record for CVE-2026-118527 at MITRE and no NVD entry, so no NVD CVSS score exists and this page shows severity as unknown. The 4.3 figure in circulation is Ivanti's own rating as reported by secondary sources. Expect the NVD record to appear and the rating here to change.

Affected Versions

These ranges come from Ivanti's 2026-10-29 advisory update as relayed by secondary reporting, since no CVE or NVD record carries version data yet. The appliance Volexity investigated was running 22.8R2.4 Build 19097, the newest build available at the time. Treat the vendor advisory as authoritative for your code line.

Technical Details

The relevant weakness class is CWE-340, generation of predictable numbers or identifiers, with a write-then-validate ordering bug alongside it. wu.cgi stores an upload at /home/runtime/tmp/<MD5 of the filename>. The filename comes from the request, so the attacker computes the destination path before sending anything: there is no random component, no per-session salt, and no unpredictable temporary name of the kind mkstemp would provide.

The second half of the problem is sequencing. The handler is meant to accept ZIP archives, but it writes the body to disk first and checks the ZIP structure afterwards, deleting the file when validation fails. A non-ZIP payload therefore exists at a fully predictable path for a short window. Volexity observed the attacker uploading a Perl script and firing parallel requests that pointed the X-DSCGI-PATH header at that path, executing the script as the cgi-server user before the cleanup ran.

Authentication is required in isolation, which is what holds the standalone score down. In the observed attack that requirement was satisfied by CVE-2026-104935, which lets an unauthenticated request to welcome.cgi be dispatched into wu.cgi by way of the same header. Complexity is moderate: winning the race means a burst of requests rather than one well-formed message.

Discovery

Volexity identified the behaviour while investigating an intrusion at a Network Security Monitoring customer starting 2026-10-05 and described the predictable MD5 path and the validation ordering in its 2026-10-13 write-up, before any CVE had been assigned to this component. Ivanti assigned CVE-2026-118527 in its 2026-10-29 advisory update and credits Volexity for the collaboration. No separate researcher credit has been published.

Exploitation Context

Volexity attributes the chain to UTA0576, a previously unknown actor it assesses with low confidence to be criminally rather than espionage motivated, and with medium confidence to be using LLMs for exploit development. Exploitation of the investigated appliance began 2026-10-03, with the honeypot operator Defused reporting attempts on the chain's entry point from 2026-10-01.

The actor planted no web shell and no backdoor. It re-ran the whole chain for every command, returning output over HTTPS, and edited /home/runtime/dlogs/debuglog and /var/log/audit/audit.log afterwards. Once at root it harvested stored domain credentials, abused the VPN's AD service account to pull LAPS passwords and BitLocker recovery keys, sprayed passwords, and captured traffic using a renamed tcpdump called dsstatmond running from /data/.icscap/.

Ivanti characterises the affected population as a limited number of customers and has published no count. No exposure figure exists for this flaw specifically, and the 5,500-plus internet-facing ICS instances Shadowserver tracks include patched systems and honeypots.

Remediation

1. Upgrade to 25.1.1.3 or 22.8R2.6. The 2026-10-13 builds addressed CVE-2026-104935 only; this flaw and CVE-2026-111357 were fixed on 2026-10-29.
2. Patch the whole chain together. Fixing the authentication bypass alone leaves an authenticated user able to drop a file at a path they choose, and fixing this alone leaves the bypass reachable.
3. Search web logs for high volumes of requests to /dana-na/auth/url_default/welcome.cgi and for X-DSCGI-PATH header values naming wu.cgi or a path under /home/runtime/tmp/. A request whose URL path and header disagree is the clearest single indicator.
4. Inspect /home/runtime/tmp/ and /tmp/ for leftover upload artifacts and for the post-exploitation scripts Volexity named: ml.py, rq5.py, mk.py, rr.py, sp_run.py, spray_hits.json.
5. Do not treat a clean Integrity Checker Tool result as reassurance. ICT missed this intrusion, and the audit and debug logs were edited, so prioritise memory and network forensics plus NetFlow review of traffic from the appliance to internal servers.
6. Restrict management interface exposure and, as an interim control, have an upstream proxy or WAF strip client-supplied X-DSCGI-PATH headers.
7. If compromise is suspected, factory reset per Ivanti's recovery procedure and rotate local admin credentials, the AD integration service account, API keys, and certificates, treating LAPS passwords and BitLocker recovery keys as exposed.
8. Federal civilian agencies must remediate by 2026-11-13 under BOD 26-04 and complete the directive's forensic triage requirements.