AI analysis
Claude Opus · 7 Nov 2026, 10:20 CET
Ivanti Connect Secure flaw lets authenticated users plant files at predictable paths
Ivanti Connect Secure before 25.1.1.3 and 22.8R2.6 lets authenticated attackers write attacker-controlled files to known disk locations. CISA confirms exploitation, with a federal remediation deadline of 2026-11-13. Upgrade and follow Ivanti's mitigation guidance now.
In plain terms
Ivanti Connect Secure is a remote-access gateway, the kind of system employees use to connect securely to a company network from outside. In affected versions, files uploaded to the appliance are saved under names that can be predicted, meaning guessed in advance. Someone who already has a valid login could upload a file containing content of their choosing and know exactly where it ends up on the appliance's disk.
On its own, the official score rates this as a medium-severity problem. However, the US Cybersecurity and Infrastructure Security Agency (CISA) has added it to its catalog of vulnerabilities known to be exploited by real attackers. Any organisation running Connect Secure, especially on an internet-facing gateway, should treat it as a priority.