CVE-2026-118527: Testing Ivanti Connect Secure's Predictable-Path File Write

TL;DR

CVE-2026-118527 is a predictable-identifier flaw in Ivanti Connect Secure that lets a remote authenticated attacker write attacker-controlled content to a known location on disk. CISA added it to KEV on 2026-10-30 with a remediation due date of 2026-11-13. The KEV record states it can be chained with CVE-2026-104935 (an authentication bypass CISA says was exploited as a zero-day) and CVE-2026-111357 (local privilege escalation). The finding that matters is not "the upload succeeded" — it is "a session that never performed the upload retrieved the exact bytes from a path it computed in advance." Prove that with two accounts on a lab clone, and attach both raw transactions plus the content hash. Until then you have a scanner hit, not a vulnerability with demonstrated impact.

What this is

A predictable-identifier bug means the server names or locates a stored object using something an outsider can derive: a counter, a timestamp, a session value, a hash of client-supplied fields, or a small random space. CWE-340 (generation of predictable numbers or identifiers) and CWE-330 (insufficiently random values) both describe the class. In an upload path it becomes concrete quickly, because the identifier is usually the only thing standing between "my file" and "someone else's file."

The KEV description is specific about the outcome: an authenticated attacker can upload files with attacker-controlled content to a known location on disk. Two words carry the risk. Known means the attacker can address the file later without being told where it went. Content means the bytes are theirs. Whether that location is served over HTTP, consumed by a privileged process, or read by an administrative feature is exactly what a test has to establish — the description alone does not say.

The chain is the other half of the story. CVE-2026-104935 removes the login step entirely (CISA describes remote, unauthenticated arbitrary command execution, exploited in the wild for credential theft and data exfiltration). CVE-2026-111357 escalates a local authenticated user. A primitive labeled "authenticated only" is only as strong as the weakest path to authentication on that appliance.

Why it matters

Edge VPN appliances are the worst place to host a file-write primitive. They sit on the internet by design, they terminate sessions that carry credentials and cookies, and the network behind them usually trusts them more than it trusts anything else. An attacker who can place a file on that appliance and then reach it has a foothold that is inside the perimeter by definition.

Three groups are affected:

• Teams running Connect Secure as their remote-access path. The appliance is the front door; a chain that starts there bypasses everything behind it.
• Teams treating "requires authentication" as a mitigation. If the companion CVE removes authentication, the qualifier evaporates. Prioritize on the chain, not the individual label.
• Teams that verify compromise with disk integrity checks only. CISA's alert notes that Ivanti's Integrity Checker Tool may not detect exploitation of CVE-2026-104935 because the commands execute in memory. A clean disk check is not a clean appliance.

If the primitive is ignored, the failure mode is quiet: a file appears in a directory nobody baselines, sits unretrieved, and gets used weeks later after logs rotate.

How it works

Mechanism, in the general case: a user-facing feature accepts client-supplied content and stores it. The server derives the stored file's identifier from a low-entropy source. Because the identifier is derivable or enumerable, a second party can address the object without ever being handed a link. Access control, if any, is keyed to the name rather than to the object's owner — so guessing the name is the authorization.

Affected versions. The KEV record does not publish a version matrix for CVE-2026-118527. CISA's companion alert for CVE-2026-104935 lists versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior, and states that 22.8 reaches end of life on January 31, 2027. That matrix belongs to CVE-2026-104935 — do not infer the 118527 matrix from it. Pull the fixed-build list from the Ivanti security advisory referenced in the KEV record and record the build string you actually observed on the appliance.

Validation design. Four steps, in order: (1) identify an upload feature reachable by a low-privilege authenticated role; (2) upload a benign marker file from account A and record every identifier the response discloses; (3) repeat three times and model the identifier — sequential, timestamp-derived, or a hash of known inputs; (4) request the predicted path from account B and from an unauthenticated session, with a random nonexistent path as control. The comparison of those two responses is the finding.

Detection and response

On the appliance and in front of it, the telemetry that matters is asymmetric: uploads are noisy and repeated, retrieval is quiet and singular.

• HTTP logs. POSTs to upload or configuration-import endpoints that are unusual for the client population. GETs whose path matches a generated filename pattern and returns 200. Any 200 response to an unauthenticated request for a path under an upload, temp, or web-accessible directory.
• Filesystem baseline. Hash inventory of upload, temp, and web directories, refreshed on a schedule. Alert on new files whose names match the derived pattern, and on files whose content hash is not in the vendor manifest.
• Process and memory. Because commands from the companion auth-bypass CVE run in memory, pair disk checks with network forensics and memory capture if you have any reason to suspect exploitation. CISA points teams at network and memory forensics for exactly this reason.
• Authentication anomalies. Successful logins from new ASNs, sessions reused across geographies, administrative actions taken by accounts that normally only read.
• Egress. The appliance opening outbound connections to destinations that are not your update infrastructure.

A defender who checks only for new files will miss the in-memory half of the chain. A defender who checks only authentication logs will miss the file that is already on disk. Run both, and keep the file-hash baseline so the next upload is provable rather than arguable.

What to do

1. Inventory every Connect Secure instance — internet-facing or not — with the build string, management interface reachability, and whether the 22.8 branch is still in service. Note the January 31, 2027 end-of-life date in the migration plan.
2. Patch against the chain, not the individual CVE. CISA's due date for CVE-2026-118527 under BOD 26-04 is 2026-11-13. If the build removes CVE-2026-104935 but not 118527, you have closed the delivery path and left the primitive.
3. Hunt the exposure window. If the appliance ran an affected build after 2026-10-13, assume the auth bypass was reachable. Follow vendor recovery guidance: back up the configuration, factory reset, upgrade, restore configuration, then rotate credentials that transited the device.
4. Reproduce on a lab clone, not production. Take a snapshot, restore it offline, and test there. Do not drop anything executable onto a production appliance.
5. Run the two-account test. Account A uploads a file containing a unique marker string with benign content. Record the response body, any Location header, and any returned identifier. Repeat three times. Diff the identifiers and write down the derivation you believe is in play.
6. Predict, then retrieve. Request the computed path from account B. Then request it with no session at all. Then request a random nonexistent path in the same directory as your control.
7. Attach evidence a second person can check. Both raw request/response pairs, the marker string, the SHA-256 of the uploaded content, the exact path, the identities used, timestamps in UTC, and the control response (typically 404) next to the 200. If retrieval succeeded, stop testing execution and write the finding.
8. Fix the class in your own code. Identifiers for stored objects come from a CSPRNG with at least 128 bits of entropy, storage lives outside any served directory, and retrieval authorization is evaluated against the object's owner — never against knowledge of the name.

Where this fits in a program

A KEV entry with two chain partners is a queue item, not a finding. The next step is to confirm which appliances run a fixed build, then prove on a clone whether the write primitive is actually reachable and retrievable. That gap between a scanner hit and evidence a second person can check is what Trusteed's validation gate is built around: exploitability context decides what reaches an analyst queue.

FAQ

Is CVE-2026-118527 exploitable without credentials? Not on its own. The KEV description specifies a remote authenticated attacker. The reason it is urgent is the chain: CVE-2026-104935 is an authentication bypass, so on an unpatched appliance the authentication requirement may no longer be a barrier.

How is it different from CVE-2026-104935 and CVE-2026-111357? Different primitives and different evidence. CVE-2026-104935 gets you in without credentials. CVE-2026-118527 puts attacker-controlled content at a predictable location once you are in. CVE-2026-111357 turns a local authenticated user into a more privileged one. Each needs its own test and its own proof; the chain is the impact story.

How do I prove impact without uploading a web shell? You do not need one. The proof is retrieval: a session that did not upload the file obtains the exact bytes from a path it computed. A unique marker string plus its hash is sufficient, and it is safer to handle than executable content.

Does a clean Integrity Checker Tool run mean the appliance is clean? No. CISA's alert states the tool may not detect exploitation of CVE-2026-104935 because the threat actor's commands execute in memory. Treat a clean disk check as one data point and pair it with network and memory forensics.

Which versions are affected by CVE-2026-118527? Get that from the Ivanti advisory linked in the KEV record. The version list published in CISA's companion alert covers CVE-2026-104935, not this one, and should not be substituted.

Sources

• CISA Known Exploited Vulnerabilities Catalog (entry for CVE-2026-118527, added 2026-10-30, due 2026-11-13) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA alert: "CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure" (CVE-2026-104935, affected versions, recovery steps, Integrity Checker limitation) — https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure
• NVD entry for CVE-2026-118527 (carries the Ivanti advisory reference and version data when published) — https://nvd.nist.gov/vuln/detail/CVE-2026-118527
• NVD entry for CVE-2026-104935 — https://nvd.nist.gov/vuln/detail/CVE-2026-104935
• NVD entry for CVE-2026-111357 — https://nvd.nist.gov/vuln/detail/CVE-2026-111357
• OWASP Web Security Testing Guide, testing for file upload and authorization bypass — https://owasp.org/www-project-web-security-testing-guide/
• Trusteed on validation and exploitability context — https://trusteed.io