Cisco, GitLab and Ivanti: three remote-access flaws under active attack in one week

Two additions to one list on one day

On 29 October 2026 CISA added two flaws to its Known Exploited Vulnerabilities catalog. One affects Cisco Secure Firewall ASA and FTD software. The other affects self-managed GitLab Community Edition and Enterprise Edition. Each entry carries a remediation deadline of 1 November 2026 for United States federal civilian agencies under Binding Operational Directive 26-04. [4][9][11][4][9][11]

The catalog is a list of flaws with evidence of active exploitation. It is not a list of theoretical risks. CISA's directive binds federal agencies. Other organisations should treat the deadline as a priority signal rather than a legal order. The two flaws differ in impact. One crashes a firewall. The other can hand an attacker code execution on a code-hosting server. [4][9][10][4][9][10]

The Cisco flaw: a crash through the VPN login

CVE-2026-76418 sits in the Remote Access SSL VPN service of Cisco ASA and FTD software. Cisco rates it 8.6 on the CVSS scale. The cause is logic errors when secondary authentication is configured on a tunnel group. An unauthenticated remote attacker can send a crafted request while connecting to the SSL VPN. A successful request forces the device to reload. [1][2][3][1][2][3]

A reload is a denial of service. It takes the firewall offline for a time. It does not by itself steal data or hand over control. Cisco says a successful VPN login is not required to reach the affected code path. Three conditions must hold: a vulnerable release, an SSL VPN login service that is reachable and secondary authentication configured on a tunnel group. The default group DefaultWEBVPNGroup is in scope when it uses secondary authentication. [1][3][1][3]

Cisco became aware of active exploitation during October 2026. The company has not named the attackers. It has not published indicators of compromise. It has not described the scale of the attacks or the organisations targeted. [1][3][1][3]

How exposed Cisco firewalls are

Shadowserver tracks more than 51,000 Cisco ASA SSL VPN devices exposed to the internet. That count comes from BleepingComputer's reporting of Shadowserver data. It does not show how many devices are patched. It does not separate honeypots from real firewalls. The number still shows the size of the attack surface. [3][12][3][12]

This is the second actively exploited denial-of-service flaw in the same VPN service in about three months. Cisco patched CVE-2026-20349 in August 2026. CISA added that flaw to the exploited catalog too. The pattern matters. Attackers return to the same internet-facing service because it guards remote access for whole organisations. [3][12][3][12]

Cisco offers no full workaround for CVE-2026-76418. The fixed releases are ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1, plus FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1. Teams that cannot patch at once can disable secondary authentication on affected tunnel groups. Cisco cautions that this step makes remote access less secure. It is exposure reduction rather than a fix. [1][12][1][12]

The GitLab flaw: code without logging in

CVE-2026-97229 is an integer overflow in the way GitLab compiles regular expressions in CI/CD configuration files. GitLab rates it 10.0 on the CVSS scale. The flaw sits in Onigmo, the regular expression engine built into Ruby. A specially crafted expression in a CI configuration could let an unauthenticated attacker run code on the GitLab server. [4][5][6][4][5][6]

The flaw affects self-managed GitLab Community Edition and Enterprise Edition. GitLab.com and GitLab Dedicated were already patched. GitLab released fixes on 12 October 2026 in versions 19.2.8, 19.3.5 and 19.4.2. Security firm Rapid7 published proof-of-concept code on 13 October. A public exploit recipe raises the urgency for unpatched servers. [4][6][9][4][6][9]

CISA's entry marks ransomware use as unknown. That status does not establish a ransomware link. CISA's alert does not name attackers or victims. It does not describe the scale of exploitation. The confirmed fact is narrower: CISA holds evidence of active exploitation. [4][9][4][9]

The Alpine lesson: the upgrade that did not fix it

Alpine Linux runs its own GitLab server. It hosts the aports repository from which Alpine packages are built. On 28 October Alpine disclosed an attempted attack on that server. A newly registered account sent crafted CI configurations on 20 and 21 October. The attack crashed GitLab worker processes eight times. In four crashes the attacker got partway through the exploit and failed at the next step. [5][6][5][6]

Alpine had upgraded to GitLab 19.3.4 on 13 October by mistake instead of the fixed 19.3.5. It upgraded to 19.3.6 on 22 October. That upgrade did not close the flaw. GitLab's fix is a set of patches to the Ruby that GitLab bundles in its own packages and container images. Alpine's image uses standard Ruby separately. The GitLab upgrade left the vulnerable component untouched. [5][6][5][6]

Upstream Ruby shipped the fix on 23 October in versions 3.3.13, 3.4.12 and 4.0.9. Alpine found the gap on 26 October. It closed the server on 27 October and rebuilt it from scratch. The rebuild finished on 28 October with all passwords reset and secret keys replaced. Alpine found no evidence that attacker code ran. It cannot rule that out because a successful exploit leaves no crash and no trace in web logs. [5][10][5][10]

The lesson travels beyond Alpine. Any GitLab install running its own Ruby from source or in a custom container image needs a Ruby update as well as a GitLab update. GitLab's own packages and official images carry the patched Ruby. A second GitLab regular-expression flaw, CVE-2026-110264, was fixed in the 21 October releases. Installing the CVE-2026-97229 update alone does not fix that second flaw. [4][5][9][4][5][9]

The Ivanti chain: from login page to root

A third attack ran through October against Ivanti Connect Secure VPN appliances. Forensics firm Volexity tracked the actor as UTA0576. Activity began on 3 October. Volexity found the compromise on 5 October at a customer running a fully patched appliance on version 22.8R2.4. Ivanti later confirmed attacks against a limited number of customers. [7][8][7][8]

The chain starts with an authentication bypass in welcome.cgi, the public login script. A mismatch between the requested URL and the X-DSCGI-PATH header let the attacker reach a protected upload handler without signing in. The handler wu.cgi wrote uploads to a predictable temporary location before checking whether each file was a valid ZIP file. The attacker uploaded a Perl script and ran it before the appliance deleted it. [7][8][7][8]

The attacker then abused the privileged dsinvoked service. Changes to library code in memory and to a maintenance task in the DSCache configuration store made the service run attacker code as root. The payload restored the changed settings and memory afterwards. No backdoor or web shell was left behind. The chain was repeated for each command with results returned through HTTPS responses. [7][8][7][8]

Once inside, the attacker extracted stored domain credentials and used the appliance's Active Directory service account to query internal systems. Targets included Windows LAPS administrator passwords and BitLocker recovery keys. Volexity warns that memory-only changes and restored settings escaped Ivanti's Integrity Checker. A clean integrity check alone cannot rule out this compromise. [7][8][7][8]

Ivanti released additional fixes on 29 October 2026. The fixes cover CVE-2026-111357 and CVE-2026-118527, the remaining flaws in the chain. The resolved versions are 25.1.1.3 and 22.8R2.6 on those branches. Ivanti tracks CVE-2026-104935 for authentication bypass and code execution, CVE-2026-111357 for privilege escalation and CVE-2026-118527 for a predictable-filename weakness. [7][13][7][13]

Why remote-access boxes keep getting hit

This section is analysis, not a new finding. Three different products share one trait. Each one sits at the edge of a network and answers requests from the internet. A firewall VPN portal, a code server that accepts CI configurations and a VPN appliance login page all have to be reachable to do their jobs. Reachability is also what lets an attacker probe them without any account. [1][4][7][1][4][7]

Patching lags behind disclosure for a second reason. Edge boxes run stable releases that change slowly. Teams test updates before they deploy them. Attackers test exploits faster. Public proof-of-concept code for the GitLab flaw appeared one day after the fix. Alpine's attacker probed eight days after the fix. [6][9][6][9]

Bundled components add a third delay. A product can be patched while a component inside it stays vulnerable. GitLab's fix patched Ruby inside its own packages. Installs with their own Ruby needed a second update. The version number on the product told only half the story. [5][6][5][6]

What the KEV list is and what the deadline means

The Known Exploited Vulnerabilities catalog lists flaws with evidence of real-world exploitation. CISA adds entries as evidence arrives. Each entry names a required action and a due date. Binding Operational Directive 26-04 turns those dates into orders for federal civilian agencies. [4][9][4][9]

The 1 November 2026 date binds that group only. Private companies, schools and other organisations face no CISA order from this listing. The date still works as a triage signal. A flaw attackers already use deserves to move ahead of flaws they merely could use. [4][10][11][4][10][11]

CISA's GitLab entry marks forensic triage as required under BOD 26-04. That means checking whether attackers reached a system before the patch landed. A version number alone does not answer that question. Logs, crash records and memory analysis do. [4][9][4][9]

What administrators should do now

This section is practical guidance drawn from the vendor advisories above. Cisco teams should move to a fixed ASA or FTD release. Check whether secondary authentication is configured on any tunnel group, including DefaultWEBVPNGroup. Review crash and reload records for unexplained reboots during October. An unexplained reboot on an internet-facing device deserves treatment as a possible sign of exploitation. [1][3][12][1][3][12]

GitLab teams should confirm both halves of the fix. Self-managed installs need 19.2.8, 19.3.5, 19.4.2 or later. Source and custom-image installs also need Ruby 3.3.13, 3.4.12, 4.0.9 or later. Check for the separate CVE-2026-110264 fix from the 21 October releases. GitLab published detection rules for exploitation attempts against self-managed servers. [4][5][9][4][5][9]

Ivanti teams should move to the October fixes and look beyond version numbers. Check welcome.cgi traffic, mismatched request paths and headers and suspicious files in temporary storage. Suspected compromises need memory, disk and network analysis because the attacker removed selected log entries. [7][8][7][8]

What this means if you are not an administrator

This section is practical guidance for readers who do not run these systems. Most readers do not run a Cisco firewall or a GitLab server. The direct impact for them is downtime rather than personal exposure. An office VPN can go dark when its firewall crashes. A code-hosting service can close while its team rebuilds it. Alpine closed its GitLab to everyone except developers and build servers on 27 October and reopened it on 29 October. [3][5][3][5]

Consumer VPN apps are a different product from enterprise VPN appliances. This week's flaws affect enterprise boxes and self-managed servers. They do not by themselves mean a phone VPN app is broken. Keep apps and devices updated and follow notices from the vendor that runs the service you use. [1][4][7][1][4][7]

Password reuse deserves one note. Alpine reset every account password after treating its server as compromised. It warned users who reused a GitLab password elsewhere to change it there too. A breach of one service becomes a breach of others when the same password unlocks both. [5][6][5][6]

What to watch next

The first test is the 1 November deadline. Federal agencies must remediate both KEV entries by that date. Watch whether CISA updates either entry after the deadline. Watch whether exploitation reports widen beyond the cases already disclosed. [4][9][11][4][9][11]

The second test is the second GitLab flaw. CVE-2026-110264 arrived in the 21 October releases with the same maximum score. Teams that patched only the first flaw still carry the second path. Vendor advisories for both flaws are the reference point. [4][9][4][9]

The third test is Cisco's wider pattern. August brought another actively exploited VPN denial-of-service flaw. Early October brought an actively exploited Secure Email Gateway flaw with remote root execution. The question is whether November brings another firewall flaw or a quieter month. [3][12][3][12]

What we still do not know

Attribution is missing for the Cisco and GitLab attacks. Cisco has not named the actor behind the firewall exploitation. CISA's GitLab entry does not name the actor either. Alpine's attacker is unidentified in the disclosure. Scale is missing too. Neither vendor nor CISA has described how many organisations were hit. [1][4][5][1][4][5]

Success is unproven in the Alpine case. Alpine found no evidence that attacker code ran. It cannot rule it out because logs from the attack period are partly gone. The rebuilt server and reset passwords close the incident for Alpine. They do not answer whether the attacker ever held code execution. [5][6][5][6]

Cisco has published no indicators of compromise for CVE-2026-76418. Defenders cannot scan for a known fingerprint of this attack. Crash and reload records are the practical signal instead. That gap makes the patch itself the main defence. [1][3][1][3]