CVE-2026-118527
Medium · 4.3 CISA KEVCVSS
4.3
EPSS
0.8%
Published
Nov 3, 2026
CISA due date
Nov 13, 2026
The record
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-85297 Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud… CWE-340
- CVE-2026-79980 The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier… CWE-340
- CVE-2026-46347 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-340
- CVE-2026-46346 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-340
- CVE-2026-64964 ATutor generates predictable email confirmation tokens due to the use of insufficiently… CWE-340
- CVE-2026-13577 Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG… CWE-340
- CVE-2026-47085 An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. CWE-340
- CVE-2026-56016 CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from… CWE-340