Skip to content

CISA KEV this week: Cisco ASA, GitLab, Ivanti, PHP

Between 26 and 30 October 2026 CISA added actively exploited flaws in Cisco Secure Firewall ASA and FTD, GitLab CE/EE, Ivanti Connect Secure and PHP to its Known Exploited Vulnerabilities (KEV) catalog, with federal due dates from 29 October to 13 November. Network, VPN, DevOps and web server owners should patch now, whatever sector they are in.

Runbook card

What changes: eight CVEs are now listed as exploited in the wild (catalog version 2026.10.30).
Who: owners of Cisco ASA/FTD remote access VPN, self-managed GitLab, Ivanti Connect Secure, PHP web servers, VMware ESX and Linux hosts.
By when: the KEV due dates are binding only on US federal civilian agencies, but they are a fair "patch by" date for everyone: 29 October (PHP), 31 October (Linux kernel), 1 November (Cisco, GitLab), 2 November and 13 November (Ivanti), 11 November (VMware ESX).
Do this: 1. Find which of these products you run and where they face the internet. 2. Apply the vendor fix from the vendor advisory. 3. Check for signs of exploitation before and after patching.
Check: the per-product commands below (read-only).
Source: CISA KEV catalog, read as JSON on 31 October 2026.

CVE Product Added Due Jump to
CVE-2026-76418 Cisco Secure Firewall ASA and FTD 29 Oct 1 Nov Cisco
CVE-2026-97229 GitLab CE/EE 29 Oct 1 Nov GitLab
CVE-2026-111357, CVE-2026-118527 Ivanti Connect Secure 30 Oct 2 Nov, 13 Nov Ivanti
CVE-2026-109618, CVE-2026-109619 PHP 26 Oct 29 Oct PHP
CVE-2026-41709, CVE-2026-46300 VMware ESX, Linux kernel 28 Oct 11 Nov, 31 Oct Also added

CISA lists "Known ransomware campaign use" as "Unknown" for all of them.

Cisco ASA / FTD: CVE-2026-76418

CISA: an "unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition."

Cisco's advisory (first published 28 October 2026, CVSS 8.6) says the flaw is in the Remote Access SSL VPN service and is due to "logic errors when secondary authentication is configured on a tunnel group". A device is affected when it runs a vulnerable release, the SSL remote access VPN login service is reachable, and secondary authentication is configured in the tunnel group scope. Cisco says it "became aware of active exploitation of this vulnerability" in October 2026 and that "There are no workarounds".

Check (read-only, ASA CLI):

show version
show running-config webvpn
show running-config tunnel-group | include tunnel-group|secondary-authentication-server-group
show running-config webvpn | include tunnel-group-list

If webvpn is enabled on an interface and any tunnel group, including DefaultWEBVPNGroup, has secondary-authentication-server-group, the device is in scope. Cisco notes that disabling the group list does not remove exposure if the default group uses secondary authentication. On FTD, review the deployed remote access VPN policy in Secure Firewall Management Center or Device Manager.

Fix: use the Fixed Software section of the Cisco advisory to find the first fixed release for your train. Watch for unexpected reloads (show crashinfo): each one drops every remote access VPN session.

GitLab: CVE-2026-97229

CISA: an integer overflow "that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation."

GitLab's critical patch release of 12 October 2026 rates it CVSS 10.0 and lists impacted versions as "all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2". GitLab.com and GitLab Dedicated are already patched; this is for self-managed instances. CISA notes that other products "can potentially be affected by the same underlying Ruby/Onigmo Integer Overflow issue" and points to a Ruby advisory.

Check: Admin area > Dashboard shows the version, or open /help on your instance. On the server: sudo gitlab-rake gitlab:env:info.

Fix: upgrade to 19.4.2, 19.3.5 or 19.2.8 or later. If you run a release older than 19.2, GitLab's notice doesn't say whether it is affected; move to a supported, patched release. GitLab published threat detections for exploitation attempts in the same release note. Review CI/CD configuration changes from untrusted contributors, and rotate runner and deploy tokens if you find signs of exploitation.

Ivanti Connect Secure: CVE-2026-111357 and CVE-2026-118527

Both were added on 30 October 2026. CISA's descriptions:

  • CVE-2026-111357 (due 2 November): a "missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges."
  • CVE-2026-118527 (due 13 November): a "generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk."

CISA says each "can be chained" with the other and with CVE-2026-104935. CISA links Ivanti's security advisory; we have not read it yet, so we don't list fixed versions here.

Do this: confirm your Connect Secure version in the admin console, apply the fixed release named in Ivanti's advisory, and run Ivanti's integrity checker if your version supports it. Treat the appliance as a likely target: review admin logins and any files that appeared on it recently.

PHP: CVE-2026-109618 and CVE-2026-109619

Added on 26 October 2026, due 29 October. CISA: CVE-2026-109618 "allows for unauthenticated remote code execution" through memory corruption; CVE-2026-109619 is a "stale internal request-state vulnerability that allows for unauthenticated remote code execution." CISA published an alert on 21 October, "Critical Vulnerabilities in PHP Require Immediate Patching".

Check: php -v on each web host, and the PHP version in every container base image you build from.

Fix: install the latest patch release of your PHP branch from php.net or your distribution. Take PHP versions that no longer receive security fixes off the internet.

Also added: VMware ESX and Linux kernel

Added on 28 October 2026:

  • CVE-2026-41709, Broadcom VMware ESX (due 11 November): "an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged." Check who holds ESX admin access, and patch per Broadcom's advisory.
  • CVE-2026-46300, Linux kernel (due 31 October): a missing initialisation flaw in socket buffer coalescing during ESP (IPsec) input processing that allows "unintended modification of page-cache-backed data". Install your distribution's kernel update and reboot. Check with uname -r.

Why it matters

Edge devices and developer platforms keep showing up together in KEV for a reason: a VPN concentrator or a CI server is reachable from the internet and holds the keys to everything behind it. No Microsoft product was added to KEV in this period.

Related: all dated actions we track are on Microsoft 365 security deadlines. For the Microsoft side of the estate, start with the M365 Hardening Kit. More Threats & vulnerabilities news.

Sources

Last reviewed: 31 October 2026. Runbook Lab is not affiliated with Microsoft, Cisco, GitLab or Ivanti.