Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-10-30
• Urgent advisory from CERT-FR, NCSC-NL

[ Description ]Official description

Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.

CISA: Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 13 Nov 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

• Security bulletin: Ivanti CVE-2026-104935Vendor patch or bulletin · CERT-FR · hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2, cited by CERT-FR CERTFR-2026-AVI-1442
• Security bulletin: Ivanti Security Advisory Ivanti Connect Secure (CVE-2026-104935)Vendor patch or bulletin · CERT-FR · hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2, cited by CERT-FR CERTFR-2026-ALE-013

[ Advisories ]Government CERT advisories

• CERT-FR2 Nov 2026CERTFR-2026-AVI-1442

  Multiple vulnerabilities in Ivanti Connect Secure Translated from French

  De multiples vulnérabilités ont été découvertes dans Ivanti Connect Secure. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un contournement de la…

  CVE-2026-104935CVE-2026-111357CVE-2026-118527
• CERT-FR14 Oct 2026CERTFR-2026-ALE-013

  [MàJ] Multiples vulnérabilités dans Ivanti Connect Secure (ICS) FR

  [Mise à jour du 2 novembre 2026] Le 29 octobre 2026, Ivanti a mis à jour son avis de sécurité du 13 octobre 2026 pour ajouter deux vulnérabilités (CVE-2026-111357 et CVE-2026-118527). Celles-ci permettent à un attaquant…

  AlertCVE-2026-104935CVE-2026-111357CVE-2026-118527
• NCSC-NL13 Oct 2026NCSC-2026-0416

  ZeroDay kwetsbaarheden verholpen in Ivanti Connect Secure NL

  Probability/damage H/HCVE-2026-104935CVE-2026-111357CVE-2026-118527

[ References ]References

• hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935Vendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource