Generation of Predictable Numbers or Identifiers Vulnerability
Exploited in the wild. CISA added it to its Known Exploited Vulnerabilities list on 30 Oct 2026.
4.3of 10, medium
Reading the vendor advisory
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-118527. Nothing runs until you send it.
Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.
You are affected if
The fix