{"basis":"claimed","id":"CVE-2026-118527","name":"Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability","vendorProject":"Ivanti","product":"Connect Secure","publishedAt":null,"cvss":null,"exploited":{"kevAdded":"2026-10-30","dueDate":"2026-11-13","ransomware":false},"epss":null,"coverage":{"cloudflare":{"status":"none","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"none","firstOn":null,"daysToRule":null},"f5":{"status":"none","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":null,"description":"Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.","cwes":["CWE-340"],"vendors":[{"vendor":"cloudflare","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T22:17:38.477Z","cvssVector":null,"ssvc":null,"measured":[],"social":{"total":4,"first_seen":"2026-11-02T19:15:39.698Z","daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":4}],"top_posts":[{"source":"x","kind":"post","url":"https://x.com/DFIR_Radar/status/2117346460723269668","author":"DFIR_Radar","author_name":"DFIR Radar","avatar_url":"https://pbs.twimg.com/profile_images/2033689817951682561/1fQAvsug_bigger.jpg","text":"Three chained Ivanti Connect Secure zero-days (CVE-2026-104935, CVE-2026-111357, CVE-2026-118527) exploited in the wild since October 3, granting unauthenticated root access. All three are now in CISA KEV. Patches exist for all three as of October 29.\n\nKey findings:\n\n- The chain…","engagement":1,"posted_at":"2026-11-02T20:01:49.000Z"},{"source":"x","kind":"post","url":"https://x.com/ADKCyber/status/2117365820036972598","author":"ADKCyber","author_name":"ADK Cyber","avatar_url":"https://pbs.twimg.com/profile_images/2049220386299260928/8q30ayLF_bigger.jpg","text":"Ivanti patched two new zero-days in Connect Secure (CVE-2026-111357, CVE-2026-118527) chained in attacks and added to CISA KEV. Review and update VPN instances. https://t.co/YGPNdY0Uv7\n\nvia SecurityWeek\n\n#CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/S4…","engagement":0,"posted_at":"2026-11-02T21:18:44.000Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/alt.pds.lefht.cc/post/3mzdzwfrg5c25","author":"alt.pds.lefht.cc","author_name":"alt","avatar_url":null,"text":"5. CVE-2026-118527 · 8 people 🔥\n\nNo published details yet (the CVE may still be reserved).","engagement":0,"posted_at":"2026-11-02T19:15:40.339Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/alt.pds.lefht.cc/post/3mzdzwf5fjc25","author":"alt.pds.lefht.cc","author_name":"alt","avatar_url":null,"text":"🛡️ Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-98432 · 33 people\n2. CVE-2026-97229 · 10 people 🔥\n3. CVE-2026-109618 · 9 people 🔥\n4. CVE-2026-111357 · 9 people 🔥\n5. CVE-2026-118527 · 8 people 🔥\n\n🔥 = on CISA's Known Exploited list · details in the thread 🧵","engagement":0,"posted_at":"2026-11-02T19:15:39.698Z"}],"exploit_repositories":[]}}