CVE-2026-118527

CVE Enrichment

CISA KEV: Not listed

Last enrichment sync: 31-Oct-2026 07:13
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (4)

The newly patched bugs are CVE-2026-111357 and CVE-2026-118527. Ivanti Patches Two More Exploited Connect Secure Zero-Days
Threat actors exploited these two flaws (tracked as CVE-2026-111357 and CVE-2026-118527) alongside an authentication bypass vulnerability (CVE-2026-104935), which Ivanti patched last month to remove the main attack Ivanti Patches Two More Connect Secure Flaws Exploited in Zero-Day Attacks
escalation vulnerability employed in the exploit chain. Patches for both CVE-2026-111357 and CVE-2026-118527 are now available in the following versions of ICS - Ivanti Patches Two Flaws Used in Exploited Three-Vulnerability Chain
CVE-2026-118527 Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability CISA Adds Two Actively Exploited Ivanti Connect Secure Vulnerabilities to KEV Catalog

CVE (2)

Threat Actors (1)

MITRE ATT&CK (2)

Vendors (1)

Products (2)

Tools (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.