CVE-2026-118527: Ivanti Connect Secure Exploited in the Wild — KEV-Listed Chained Vulnerability Detection and Remediation Guide

On October 30, 2026, CISA added CVE-2026-118527 — a Generation of Predictable Numbers or Identifiers vulnerability (CWE-340) in Ivanti Connect Secure (ICS) — to the Known Exploited Vulnerabilities (KEV) catalog. KEV inclusion is not a theoretical designation: CISA only adds vulnerabilities with confirmed active exploitation in the wild.

The flaw allows a remote, authenticated attacker to leverage predictable identifiers to upload files with attacker-controlled content to a known location on disk. That primitive — arbitrary file upload to a predictable path — is the classic precursor to web shell deployment on edge appliances. Critically, CISA and Ivanti note this vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357, meaning attackers may be combining these flaws to achieve initial access, bypass authentication requirements, and execute code on the appliance.

If you operate Ivanti Connect Secure or Ivanti Policy Secure gateways, treat this as an active incident, not a patching exercise. The mandate from CISA is twofold: mitigate per vendor instructions and comply with BOD 26-04 forensic triage requirements — meaning you are expected to preserve and collect forensic evidence before wiping or rebuilding compromised appliances. Organizations that factory-reset a compromised ICS box without imaging it are destroying the only evidence of what attackers did while they had access.

Technical Analysis

The Vulnerability: Predictable Identifiers Enable Arbitrary File Upload

CVE-2026-118527 is classified as CWE-340 — Generation of Predictable Numbers or Identifiers. In practical terms, ICS generates tokens, session artifacts, upload paths, or temporary file identifiers that an attacker can predict or brute-force. Combined with the upload functionality, a remote authenticated attacker can:

1. Predict the identifier/path where an uploaded file will land on disk.
2. Upload a file with fully attacker-controlled content (e.g., a Perl/Python script, JSP-style payload, or modified configuration).
3. Reference or execute that file at its known location — the stepping stone to web shell deployment and post-exploitation.

The authentication requirement matters but should not be comforting: the documented chaining with CVE-2026-104935 and CVE-2026-111357 suggests attackers are combining flaws to either bypass authentication entirely, harvest valid credentials/session tokens, or escalate the upload primitive into unauthenticated remote code execution. Edge VPN concentrators are high-value targets precisely because one foothold equals visibility into — and control over — all authenticated remote access traffic.

Why Edge Appliances Are Uniquely Dangerous When Compromised

Ivanti Connect Secure appliances sit at the network perimeter, terminate TLS for remote users, hold valid user credentials and session cookies in memory, and historically run minimal EDR coverage. Most organizations have zero endpoint detection on the appliance itself — detection depends entirely on outbound syslog, Ivanti's Integrity Checker Tool (ICT), and network telemetry. Nation-state operators and ransomware affiliates alike have repeatedly demonstrated they know this.

Exploitation Status

• CISA KEV: Confirmed active exploitation (added 2026-10-30)
• Chaining risk: Documented with CVE-2026-104935 and CVE-2026-111357
• Federal mandate: BOD 26-04 compliance required, including Forensics Triage Requirements
• Attacker profile: Consistent with historical ICS campaigns — espionage actors and initial access brokers harvesting credentials and establishing persistence

Post-Exploitation Behaviors to Expect

Based on the exploitation pattern of this vulnerability class on ICS appliances, defenders should hunt for:

• Web shells dropped into web-accessible directories (e.g., under /home/webserver/htdocs/ or /home/runtime/) — the direct product of the file-upload primitive
• Modified legitimate ICS CGI/Perl components (attackers frequently backdoor existing files rather than adding new ones)
• Anomalous child processes spawned by the ICS web server (web/dswebserver spawning sh, bash, python, perl, curl, wget)
• Outbound connections from the appliance to unknown external IPs — ICS appliances have almost no legitimate reason to initiate arbitrary internet egress
• Failed or tampered Integrity Checker Tool (ICT) results, or evidence the ICT was run and its output deleted
• Credential dumping and session token theft from appliance memory and logs

Detection & Response

Sigma Rules

The following rules target the observable post-exploitation behaviors of this chain: web shell file drops on the appliance filesystem and suspicious process execution lineage from the ICS web server. Deploy these against Linux Sysmon-for-Linux, auditd, or forwarded appliance telemetry where available.

---
title: Ivanti Connect Secure Web Shell File Creation
title_note: CVE-2026-118527 post-exploitation artifact
id: 8f2c4a91-3d5e-4b7a-9c1d-2e6f8a0b4d7c
status: experimental
description: Detects creation of executable script files in Ivanti Connect Secure web-accessible directories, consistent with arbitrary file upload exploitation and web shell deployment.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-118527
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/10/30
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_paths:
    TargetFilename|contains:
      - '/home/webserver/htdocs/'
      - '/home/runtime/'
      - '/data/runtime/'
      - '/tmp/'
  selection_ext:
    TargetFilename|endswith:
      - '.cgi'
      - '.pl'
      - '.py'
      - '.sh'
      - '.php'
  condition: selection_paths and selection_ext
falsepositives:
  - Ivanti vendor updates and hotfix installations (correlate with change windows)
level: high
---
title: Ivanti Connect Secure Web Server Spawning Shell or Script Interpreter
id: 4b7e1d92-6a3f-4c8e-b2d9-5f0a7c1e8d3b
status: experimental
description: Detects the Ivanti Connect Secure web server process spawning shells or script interpreters, a hallmark of web shell interaction and chained exploitation of CVE-2026-118527.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-118527
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/30
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - '/home/bin/web'
      - 'dswebserver'
      - '/home/bin/monkey'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/openssl'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; some legitimate ICS maintenance scripts. Investigate every hit.
level: critical

KQL Hunt — Microsoft Sentinel / Defender

This query hunts for proxy/firewall/VPN logs (ingested via CEF/Syslog into CommonSecurityLog or Syslog) showing outbound connections originating from ICS appliances to rare external destinations, plus HTTP requests targeting suspicious upload or script endpoints. Run it over the past 30 days and baseline against known management traffic (Ivanti update servers, your syslog/SIEM collectors, license servers).

// Hunt 1: Outbound connections FROM Ivanti ICS appliances to rare destinations
let ICSHosts = dynamic(["ics-vpn-01", "ics-vpn-02"]); // TODO: replace with your ICS hostnames/IPs
let KnownGoodDests = dynamic(["license.ivanti.com", "download.ivanti.com"]); // baseline legitimate egress
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where SourceHostName in~ (ICSHosts) or SourceIP in~ (ICSHosts)
| where DeviceAction !in~ ("deny", "blocked")
| where DestinationHostName !in~ (KnownGoodDests)
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Ports = make_set(DestinationPort) by SourceIP, DestinationIP, DestinationHostName
| order by ConnectionCount asc; // rare outbound destinations surface first

// Hunt 2: Requests to suspicious script/upload paths on the ICS gateway (proxy/WAF logs)
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where RequestURL has_any (".cgi", ".pl", ".py", "upload", "/dana-na/", "/dana/html5acc/")
| where RequestURL has_any ("..", "%2e", "%252e", "cmd", "shell", "eval", "base64")
| summarize Hits = count(), SrcIPs = make_set(SourceIP), FirstSeen = min(TimeGenerated) by RequestURL, RequestMethod
| order by Hits desc;

Velociraptor VQL — Appliance and Jump-Host Forensics

If you have Velociraptor deployed on management jump hosts, or can collect from a Linux system adjacent to the ICS appliance (or an exported ICS filesystem mounted for triage), this artifact hunts for recently created/modified scripts in web-accessible paths and suspicious process lineage:

-- Hunt for web shell artifacts and suspicious processes related to CVE-2026-118527 exploitation
-- Recently modified executable scripts in web-accessible directories
SELECT FullPath, Size, Mtime, Ctime, Mode
FROM glob(globs=['/home/webserver/htdocs/**/*.cgi', '/home/webserver/htdocs/**/*.pl', '/home/runtime/**/*.py', '/tmp/*.sh', '/tmp/*.pl'])
WHERE Mtime > Now() - 2592000  -- last 30 days
ORDER BY Mtime DESC

-- Suspicious process lineage: web server spawning interpreters/shells
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(curl|wget|nc |base64 -d|/bin/sh|/bin/bash|perl -e|python -c)'
   OR Exe =~ '(sh|bash|perl|python|curl|wget)$'

Baseline Verification Script (Bash)

Run the following from a management host with SSH access to the ICS appliance (or adapt for your configuration backup review) to gather first-pass triage evidence. Collect this before any remediation action that could destroy evidence, consistent with CISA's Forensics Triage Requirements under BOD 26-04.

#!/bin/bash
# CVE-2026-118527 triage collection - Ivanti Connect Secure
# Run from a secure management host. Adjust ICS_HOST and paths for your deployment.

ICS_HOST="ics-vpn-01.example.com"
OUTDIR="./ics_triage_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUTDIR"

# 1. Pull current software version and build (document patch state)
ssh admin@"$ICS_HOST" "cat /etc/version* 2>/dev/null; uptime" > "$OUTDIR/version.txt"

# 2. Export full system snapshot/config for offline analysis
ssh admin@"$ICS_HOST" "tar czf - /home/webserver/htdocs /home/runtime /var/log 2>/dev/null" > "$OUTDIR/ics_fs_snapshot.tar.gz"

# 3. Capture active network connections - look for unexpected egress
ssh admin@"$ICS_HOST" "netstat -anp 2>/dev/null || ss -anp" > "$OUTDIR/netstat.txt"

# 4. Capture running processes with full lineage
ssh admin@"$ICS_HOST" "ps auxwwf" > "$OUTDIR/processes.txt"

# 5. Grab auth and admin logs for session/token review
ssh admin@"$ICS_HOST" "cat /var/log/auth* /var/log/messages* 2>/dev/null | tail -5000" > "$OUTDIR/logs_tail.txt"

# 6. Hash everything collected for chain of custody
( cd "$OUTDIR" && sha256sum * > SHA256SUMS.txt )

echo "[+] Triage evidence collected in $OUTDIR — preserve before patching or rebuilding."
echo "[!] Next: run Ivanti Integrity Checker Tool (ICT) and a fresh external ICT scan."

Remediation

Immediate Actions (Within CISA BOD 26-04 Deadlines)

1. Apply Ivanti's mitigations per the official vendor advisory immediately. BOD 26-04 requires federal civilian agencies to remediate KEV-listed vulnerabilities within defined windows; treat this as your deadline even in the private sector. Check the Ivanti Security Advisory portal for the fixed build numbers for your ICS train and the advisories covering the chained CVEs (CVE-2026-104935, CVE-2026-111357) — patch all three, not just 118527.
2. Preserve forensic evidence BEFORE remediation. Per CISA's Forensics Triage Requirements referenced in BOD 26-04: capture disk/memory images or filesystem snapshots, netstat, process lists, and logs before patching, rebooting, or factory resetting. Rebuilding first is evidence destruction.
3. Run the Ivanti Integrity Checker Tool (ICT) — both the internal ICT and the newer external ICT — on every appliance. A clean ICT result is not proof of safety (sophisticated actors have historically tampered with ICT), but a failed result is proof of compromise.
4. Hunt retroactively. Run the Sigma/KQL/VQL content above across at least 30–90 days of retained telemetry. Assume exploitation preceded the KEV listing by weeks or months.

If Compromise Is Confirmed or Suspected

5. Factory reset the appliance and rebuild from known-good media — patching alone does not remove implants. Ivanti has consistently directed factory reset + patch for compromised ICS devices.
6. Rotate everything the appliance touched: all user credentials that transited the VPN, local admin accounts, service accounts, certificates/private keys stored on the appliance, and any RADIUS/LDAP bind credentials. Assume session tokens were harvested and enforce re-authentication.
7. Review downstream access: enumerate which internal resources VPN users accessed during the exposure window and hunt for lateral movement from those sessions.

Structural Hardening

8. Restrict management interfaces to a dedicated out-of-band management network; the admin portal must never be internet-reachable.
9. Constrain appliance egress. ICS should only reach Ivanti update/licensing servers, your syslog collector, and identity infrastructure. Deny-all egress with explicit allows turns post-exploitation C2 into a detection opportunity.
10. Forward all appliance logs (admin, auth, system, IDS/IPS events) off-box in real time to your SIEM — local logs on a compromised appliance are untrustworthy.
11. Monitor for the chained CVEs. Track Ivanti advisories for CVE-2026-104935 and CVE-2026-111357 and confirm your patch level addresses the full chain — remediating one link while leaving the others intact leaves the door open.
12. Evaluate cloud-service obligations per BOD 26-04 guidance if you consume ICS-based services from a provider, and discontinue use of any appliance that cannot be brought to a supported, patched state.

The Bottom Line

CVE-2026-118527 is not a routine patch Tuesday item — it is a KEV-listed, actively exploited flaw in a perimeter device that historically attracts the most capable adversaries in the threat landscape, and it is being chained with two other 2026 Ivanti CVEs. The defensive sequence matters: preserve evidence, hunt, patch the full chain, rebuild if compromised, rotate credentials, and harden egress. Organizations that treat edge appliances as set-and-forget infrastructure will keep reading about themselves in incident reports. Don't be that case study.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub