31 October 2026
Reference: CVE-2026-118527
1. What is being reported?
The report is about a vulnerability in Ivanti Connect Secure that allows attackers to predict certain numbers or identifiers the system uses. This predictability can let attackers gain unauthorised access or disrupt services.
2. What this means in plain English
If your organisation uses Ivanti Connect Secure, attackers could exploit this flaw to break into your network or cause problems. This could lead to data theft, disruption of services, or other security issues.
3. Could this affect a small business?
Small businesses, charities, or clubs using Ivanti Connect Secure VPN could be affected, especially if the product is exposed to the internet. Organisations not using this product or similar VPN services are unlikely to be affected.
4. What to do now
- Check if your organisation uses Ivanti Connect Secure VPN.
- Contact your IT provider or software supplier to confirm if you are affected and ask for mitigation steps.
- Apply any recommended mitigations or updates from Ivanti as soon as possible.
- If mitigations are not available, consider discontinuing use of the product or restricting its internet exposure until a fix is applied.
5. Ask your IT provider
Can you confirm if our Ivanti Connect Secure VPN is affected by CVE-2026-118527, and what steps are being taken to mitigate or fix this vulnerability?
6. Bottom line
If you use Ivanti Connect Secure, act quickly to reduce your risk from this actively exploited security flaw.
Information based on CISA KEV and reputable security reporting.