CVE-2026-118527: Ivanti Connect Secure Predictable Numbers Vulnerability Leading to File Upload

Overview

CVE-2026-118527 affects Ivanti Connect Secure, enabling a remote authenticated attacker to upload arbitrary, attacker-controlled files to a specific location on the appliance’s disk. This vulnerability is significant as it provides a critical primitive for establishing persistence or further exploitation, often chained with other vulnerabilities like CVE-2026-104935 and CVE-2026-111357. Its inclusion in CISA’s Known Exploited Vulnerabilities Catalog indicates active exploitation.

Technical Analysis

The vulnerability in Ivanti Connect Secure is related to the generation of predictable numbers or identifiers. An authenticated attacker can leverage this predictability to bypass controls and upload files containing arbitrary content to a pre-determined location on the appliance’s filesystem. This capability can be used to drop web shells, configuration files, or other malicious payloads, paving the way for further compromise. The vulnerability requires prior authentication, meaning an attacker must first obtain valid credentials. Specific affected versions are not detailed in the provided source material.

Detection

• Monitor Ivanti Connect Secure appliance logs for successful POST requests to unusual or unexpected paths, especially those with large body sizes indicative of file uploads.
• Look for subsequent GET or POST requests targeting newly created or modified files in web-accessible directories (e.g., files with extensions like .jsp, .php, .sh, .pl, .py).
• Analyze network traffic for large POST requests directed at Ivanti Connect Secure, followed by requests for unusual file types or paths that are not part of normal appliance operation.
• If filesystem monitoring is available on the appliance, detect writes to sensitive or web-root directories by unexpected processes.

Sigma Detection Rules

Ivanti Connect Secure – Suspicious File Upload Attempt

title: Ivanti Connect Secure - Suspicious File Upload Attempt
id: 9c0e4f1c-7e2a-4d3b-8c8f-1a2b3c4d5e6f
status: experimental
description: Detects suspicious file upload attempts to Ivanti Connect Secure, potentially indicating exploitation of CVE-2026-118527 or similar vulnerabilities. Looks for POST requests with common web shell extensions.
logsource:
  product: webserver
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem|endswith:
      - '.jsp'
      - '.php'
      - '.aspx'
      - '.sh'
      - '.pl'
      - '.py'
      - '.cgi'
      - '.txt' # Could be a staging file
      - '.conf' # Could be a config overwrite
    sc-status: 200
  condition: selection
level: high

Ivanti Connect Secure – Large POST Request (Potential File Upload)

title: Ivanti Connect Secure - Large POST Request (Potential File Upload)
id: 0f1e2d3c-4b5a-6c7d-8e9f-0a1b2c3d4e5f
status: experimental
description: Detects unusually large POST requests to Ivanti Connect Secure, which could indicate a file upload related to CVE-2026-118527 or other vulnerabilities. Threshold may need tuning.
logsource:
  product: webserver
detection:
  selection:
    cs-method: 'POST'
    c-bytes|gte: 102400 # Example: greater than 100KB. Adjust based on normal traffic patterns.
    sc-status: 200
  condition: selection
level: medium

Mitigations

1. Apply vendor patches immediately once they become available. Regularly check Ivanti’s security advisories for updates.
2. Implement and enforce strong authentication policies, including multi-factor authentication (MFA), for all Ivanti Connect Secure users and administrators to mitigate the risk of compromised credentials.
3. Regularly review and audit Ivanti Connect Secure appliance logs for any anomalous activity, suspicious file creations, or unusual access patterns.
4. Restrict network access to the Ivanti Connect Secure administration interface and other sensitive endpoints to only trusted IP addresses or networks.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-118527

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

• T1078 — Valid Accounts
• T1505.003 — Web Shell
• T1105 — Ingress Tool Transfer