Event Monitor Cyber
EM-20261030-1DRL VulnerabilityHigh severity

Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

CVE-2026-118527 · Ivanti Connect Secure

0 hours from first report to confirmed exploitation.

Status
Confirmed

Since : CISA added it to Known Exploited Vulnerabilities.

First Signal
Oct 30 12:00 UTCC1 CISA Known Exploited Vulnerabilities
Page Born
Oct 30 12:00 UTCsecond source joined
Last Signal
Nov 02 11:04 UTC2 days before snapshot
Sources
32 official · 1 research, news or crowd
Open For
5 daysso far

Life Of This Page

  1. 1
    Born
    A second, independent source names it.
  2. 2
    Developing
    New signals join; severity can move.
  3. 3
    Confirmed · Now
    CISA KEV lists it, or exploitation in the wild is reported.
  4. 4
    Resolved
    Not yet
    Past the fix deadline and 14 days with no new signal.
  5. 5
    Archived
    Not yet
    30 days after resolved. Read only; the link keeps working. Reopens if it comes back.

The address and ID never change. A correction is logged, never overwritten. If two pages turn out to be one incident, the later one points to the earlier.

Vulnerability Lifecycle

  1. Disclosed: reached
    Oct 30 12:00 UTC
    C1 first to name it
  2. Scored: not yet
    Not yet
    No CVSS yet
  3. Exploited: reached
    Oct 30 12:00 UTC
    C1 CISA KEV, fix by 2026-11-13
  4. Advisories: reached
    Oct 30 12:00 UTC
    1 government and CERT sources
  5. Vendor Response: not yet
    Not yet
    None in sources yet
  6. Resolved: not yet
    Not yet
    When fixed: KEV deadline 2026-11-13, then 14 quiet days

Timeline

12:00Oct 3112:00Nov 112:00Nov 212:00BornC1 CISA Known Exploited VulnerabilitC2 CISA Cybersecurity AdvisoriesC154 Rapid7

Point at a mark to read it. Squares are signals, colored by severity; every one is also listed under Signals.

Signals

  1. Additional Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-111357, CVE-2026-118527) (opens source in a new tab) Overview On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357 , a missing authentic… Med severityResearch & NewsC154 Rapid7
  2. CISA Add Two Known Exploited Vulnerabilitie to Catalog (opens source in a new tab) CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function V… High severityGovernmentC2 CISA Cybersecurity Advisories
  3. CVE-2026-111357 added to KEV: Ivanti Connect Secure Mi ing Authentication for Critical Function Vulnerability (opens source in a new tab) Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-10… High severityExploited ListC1 CISA Known Exploited Vulnerabilities
  4. CVE-2026-118527 added to KEV: Ivanti Connect Secure Generation of Predictable Number or Identifier Vulnerability (opens source in a new tab) Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. Th… High severityExploited ListC1 CISA Known Exploited Vulnerabilities