ACT NOWExploited vulnerability
Ivanti Connect Secure
Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
What's happening and what to do
A remote attacker with a valid login can upload files with content they choose to a predictable spot on the disk, and attackers are actively exploiting this flaw. It can also be chained with two other flaws. Ivanti Connect Secure. Apply the vendor's update now and check for signs of compromise, such as unexpected uploaded files on the appliance.
AI summary of the sources on this page. Regenerated when a source changes.
Signals over time
- 2026-10-30Added to CISA's Known Exploited Vulnerabilities catalog.
- 2026-11-03 21:55First seen here.
- 2026-11-13Federal patch deadline for US agencies.
Source text
Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.