This roundup covers 26 to 30 October 2026. The week made one thing clear: a score does not set the order of work. Seven entries were added to the CISA KEV catalogue, the list of flaws with proven exploitation. One of them carries a CVSS score of 10.0, another a CVSS score of 2.7. Someone has evidenced exploitation for both.
In practice that means you start with three questions. Whether you run the product at all. Whether it is reachable from the internet. And what the attacker gains. The number comes after that. This time three products are involved that are commonly used in mid-sized organisations: self-managed GitLab, Cisco firewalls with SSL VPN and VMware ESX.
Four items were covered separately earlier in the week: the critical PHP flaws known as PHP2Shell, the flaw in the Brotli library with out of band fixes for Node.js and .NET, unauthenticated file upload in Adobe Commerce and Magento, and privilege escalation in the Linux kernel. We do not repeat the full analysis here.
Full lists of fixed versions for individual branches are given with each item in the text.
1. GitLab, an unauthenticated attacker runs code on the server and exploitation is proven
CVE-2026-97229 · CVSS 10.0 · actively exploited · patch available
GitLab manages source code and automates building and deployment of applications. This flaw affects only installations an organisation runs itself (self-managed), in both the Community and Enterprise editions. GitLab.com and GitLab Dedicated are patched according to the vendor.
It is an integer overflow in the CI/CD regular expression compiler. GitLab states that under certain conditions an unauthenticated user could execute code on the server through a crafted regular expression in a pipeline configuration, because that expression was not validated sufficiently. Affected branches are 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. Fixes were released on 12 October and the vendor lists no workaround.
This is worse than it looks for two reasons. GitLab usually holds source code, deployment pipelines and tokens to cloud and production, so an attacker gains not only data but a path into the production environment. And since 29 October the flaw has been in the KEV catalogue, with a deadline of 1 November for US federal agencies, the shortest deadline CISA set this week. GitLab also published six threat detections for self-managed instances, among them rules for crashes of the native Onigmo worker and for bursts of errors during CI configuration linting.
What to do: upgrade to 19.4.2, 19.3.5 or 19.2.8, or better still straight to the set released on 21 October, that is 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. That set also fixes a second critical flaw in the regular expression compiler at CVSS 10, which we covered in our roundup of 23 October. If you cannot upgrade right away, take the instance off the internet and allow only your own network and VPN, enable the published detections and review logs for unusual worker crashes and for error bursts during CI configuration linting.
2. Cisco ASA and FTD, a device with SSL VPN can be reloaded without logging in
CVE-2026-76418 · CVSS 8.6 · actively exploited · patch available
Cisco Secure Firewall ASA and Secure FTD is the software of Cisco firewalls, on which organisations commonly also run remote access for staff over SSL VPN.
The flaw lies in the logic that handles SSL VPN logins when secondary authentication is configured on a tunnel group. An unauthenticated attacker sends a crafted request while connecting and the device reloads, which means a denial of service. According to the Cisco advisory a configuration is vulnerable when the running configuration contains the webvpn keyword, SSL VPN is enabled on at least one interface and any tunnel group has secondary authentication configured, including the default DefaultWEBVPNGroup. A successful login is not required.
This is worse than it looks because the same device carries remote access for the whole organisation and an attacker can bring it down repeatedly without holding a single account. Cisco PSIRT states that it became aware of active exploitation in October 2026, and CISA added the flaw to the KEV catalogue on 29 October with a deadline of 1 November for US federal agencies. According to the vendor there is no workaround that removes the exposure without upgrading.
What to do: upgrade ASA to 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 or 9.24.1.27 depending on the branch, and FTD to 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 or 10.1.1. First check whether this applies to you: look for webvpn in the configuration and for secondary-authentication-server-group on tunnel groups. If you cannot deploy the upgrade right away, Cisco offers a mitigation, which is to disable secondary authentication on user configured tunnel groups or on DefaultWEBVPNGroup. Treat it as a last resort for a few days, because it weakens remote access.
3. VMware ESX, an administrator can perform operations without a log entry
CVE-2026-41709 · CVSS 2.7 · actively exploited · patch available
VMware ESX is a hypervisor, the software that virtual servers run on. In mid-sized organisations it often carries the whole server room, including the domain and backups.
The flaw is insufficient logging. Broadcom states that an attacker with administrative privileges can perform certain operations without them being logged. The rating is therefore low, CVSS 2.7, and the flaw itself is not a way into the environment: the attacker already needs administrative access. The flaw was reported by Ian Barton of CrowdStrike.
This is worse than it looks because logs are what an incident is investigated from. Whoever obtains administrative credentials can move through the environment leaving a smaller trace, and defenders then have little to reconstruct events from. That the flaw is not merely theoretical is shown by its addition to the KEV catalogue on 28 October with a deadline of 11 November for US federal agencies. Fixes have been available for a long time: advisory VMSA-2026-0006 was published on 29 July 2026 and Broadcom updated it on 19 August.
What to do: deploy ESX 9.1.0.0-25370933, 9.0.2.0100-25595025 or ESXi 8.0 U3j (build 25429389), and version 5.2.4 for the 5.x branch of VMware Cloud Foundation. If that is not possible right away, reduce the number of accounts with hypervisor administrator privileges and forward ESX logs over syslog to an external collector, so that records do not stay only on a device an attacker may control.
Priority summary
| Vulnerability | Impact | Exploited | Patch | Priority |
|---|---|---|---|---|
| GitLab CVE-2026-97229 | Code execution on the server without logging in | Yes, KEV since 29 Oct 2026 | 19.5.1, 19.4.3, 19.3.6, 19.2.9 and older branches | Immediately |
| Cisco ASA and FTD CVE-2026-76418 | Firewall reload, VPN unavailable | Yes, KEV since 29 Oct 2026 | ASA 9.24.1.27 and others, FTD 7.7.14 and others | Immediately |
| VMware ESX CVE-2026-41709 | Administrator operations with no log entry | Yes, KEV since 28 Oct 2026 | ESXi 8.0 U3j, ESX 9.0.2.0100 and 9.1.0.0 | Medium |
Elsewhere in security
A crypto exchange reported funds drained after an engineer laptop was compromised
The exchange Binance reported a security incident on 29 October and suspended deposits and withdrawals across several networks as a precaution, as its spokesperson told TechCrunch. According to a company statement given to Al Jazeera, around 6.3 billion dollars was drained, of which roughly 3 billion dollars was frozen. Circle froze around 800 million dollars and Tether around 1.56 billion dollars.
The exchange stated that it will cover the losses, that user funds are safe and that it is working with law enforcement. It promised a detailed technical analysis once the investigation is over, so for now only the initial conclusion is known: the attacker made unauthorised transactions after gaining access to a compromised laptop of one of the company's engineers. Loss figures differ between sources, and estimates published before the company statement were lower. No authority or court has yet said who is behind the attack.
Review which administrators and developers can reach production from an ordinary work laptop, and whether such access requires a separate device or a second factor for every approval.
What to take away from this week
Two observations. A score does not set the order of work: this week the exploited flaw catalogue gained an entry scored 10.0 and an entry scored 2.7, and exploitation is evidenced for both. And in two of the three cases the patch was not new, it had been available for weeks or months. The difference between organisations is not how quickly a vendor ships a fix, but how long the fix sits undeployed.
A concrete task for this week: take the three entries from the priority table and answer two questions for each, whether you run the product and in which version. For GitLab that is the instance version, for Cisco a search for the webvpn keyword and for secondary-authentication-server-group in the configuration, for ESX the build number. The deadline for US federal agencies for GitLab and Cisco is 1 November and it is a reasonable yardstick for you as well.
Struggling to keep track?
We publish this roundup every week. Following it is only the first step. The harder part is knowing which vulnerabilities apply to you specifically, in what order to address them and who in the organisation is accountable for it.
We help with that: security assessment and vulnerability management · external security manager · selection and deployment of technologies
Informal consultation · Dealing with an incident right now?
We will tell you plainly what is worth addressing first. The initial consultation is free of charge.
Sources: CISA, Known Exploited Vulnerabilities catalogue · GitLab, critical patch release 19.4.2, 19.3.5 and 19.2.8 · GitLab, critical patch release 19.5.1 and older branches · CERT-EU, advisory 2026-019 on GitLab · Cisco, advisory on SSL VPN in ASA and FTD · Broadcom, advisory VMSA-2026-0006 on VMware ESX · CISA, alert on critical PHP vulnerabilities · TechCrunch, crypto exchange pauses withdrawals · Al Jazeera, exchange statement on the scale of the loss