EN
DeutschEnglishEspañolFrançaisItaliano

Start free Dashboard

Vulnerability

CVE-2026-118527

Ivanti Connect Secure: arbitrary file upload

Most severe levelDEFCON 3 · Substantial risk

Official data

CVSS 3.1
4.3 · mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-340
CISA KEV catalogue
Yes, since 30 October 2026

Sources: NVD (CVSS, weakness, publication), FIRST (EPSS), CISA (KEV catalogue).
Data read on 4 November 2026.

Timeline

  1. 30 October 2026Added to the CISA KEV catalogue
  2. 31 October 2026First in the DefenceLevel briefing
  3. 3 November 2026Published on NVD

In DefenceLevel briefings5 days

  • 4 November 2026New in the last 24 hoursDEFCON 3
  • 3 November 2026Still ongoingDEFCON 4
  • 2 November 2026Still ongoingDEFCON 4
  • 1 November 2026Still ongoingDEFCON 4
  • 31 October 2026New in the last 24 hoursDEFCON 3

Last 12 months.

The full analysis is in the briefingThe full analysis is in your archive

Why it matters now, who is affected and what to do: every day at 05:00 UTC, for subscribers.Why it matters, who is affected and what to do, as in the daily briefing.

Start freeSubscriber? Open it in your archiveOpen it in your archive

More exploited Ivanti vulnerabilities

Official records: NVDCVE.org

Search another CVE