pwned.coffeeOrder ticket · today's special · 30 Oct 2026

🔥 On the fly · exploited in the wildKEV due in 3dScalding · 540°ChighOn hold · status unknown

Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

Ivanti Connect Secure

Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.

Do this now

Check Ivanti's advisory for a fix and restrict access to Connect Secure now; hunt for unexpected uploaded files.

Still cooking for Connect Secure.

First seen: 30 Oct 2026
Last update: 30 Oct 2026, 19:17 UTC
Identifiers: CVE-2026-111357
CVE-2026-118527 ID not published yet
CVSS: 7.0
KEV deadline: 2026-11-02
Source: CISA KEV
On the menu as: VPN & firewalls

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
Severity: high, exploited in the wild. Patch status: fix status unknown.
Affected: Ivanti Connect Secure
Ids: CVE-2026-111357, CVE-2026-118527

Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.

## Steps
1. This touches infrastructure (vpn-edge). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. Connect Secure 22.8.x: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Connect Secure 22.8.x | not named in the CVE record | check the vendor advisory: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-111357") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US https://nvd.nist.gov/vuln/detail/CVE-2026-111357 https://nvd.nist.gov/vuln/detail/CVE-2026-118527 https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog
https://pwned.coffee/i/ivanti-connect-secure-generation-of-predictable-numbers-or-identifiers-v

Timeline

30 Oct 2026, 19:17 UTC
Reported by cisa.gov: CISA Adds Two Known Exploited Vulnerabilities to Catalog
30 Oct 2026
First reported.

Receipt

Exploitation: Exploited: listed in CISA KEV
CISA KEV “CVE-2026-111357 added to CISA KEV on 2026-10-30, federal deadline 2026-11-02.” source
Fix by release line: Product Affected Fixed in Source
Connect Secure = 22.8R2.4 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 30 Oct
The CVE record names no fix for one line; the vendor’s advisory may: hub.ivanti.com
Score: CVSS 7.0 (high). CVSS 3.1 7 (CNA mitre) for CVE-2026-111357
Last checked: 30 Oct 2026, 19:17 UTC

Product	Affected	Fixed in	Source
Connect Secure	= 22.8R2.4	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 30 Oct

Sources: KEV ✓ CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone hot coffee