Policy

Three exploited bugs, three deadlines: Ivanti, GitLab and Cisco VPN

CISA added two Ivanti Connect Secure bugs on October 30, chained with an October 13 flaw for unauthenticated command execution, one due November 2. GitLab and Cisco VPN bugs listed a day earlier are due November 1.

Edited by Emilio Santos 7 min read
Rows of equipment in a data center
Two VPN appliances and a code server: three exploited bugs with federal deadlines inside three days. Photo: Circuit & Capital

On Friday, October 30, 2026, CISA added two more Ivanti Connect Secure bugs to its Known Exploited Vulnerabilities catalog: CVE-2026-111357, a missing authentication flaw that allows privilege escalation, and CVE-2026-118527, a predictable identifier flaw that lets an authenticated attacker upload files to a known location on disk. The federal due date for the first is November 2, three days after listing. The day before, CISA listed a GitLab remote code execution bug, CVE-2026-97229, and a Cisco firewall VPN denial-of-service bug, CVE-2026-76418, both due November 1.

Three exploited bugs with deadlines inside three days is unusual. Two of them sit on remote-access VPN appliances, the front door for staff working off site. The third sits on a self-managed code server that often holds deployment credentials. If your organization runs any of the three, this is weekend work, not next-sprint work.

What happened

  • October 12, 2026: GitLab released critical patch versions 19.4.2, 19.3.5 and 19.2.8 for Community and Enterprise Edition. The top fix, CVE-2026-97229, is rated CVSS 10.0. GitLab said GitLab.com was already patched and Dedicated tenants were patched before release.
  • October 13: CISA added Ivanti Connect Secure CVE-2026-104935, an authentication bypass that allows a remote, unauthenticated attacker to run arbitrary commands, with a due date of October 16.
  • October 23: The Ruby project released Ruby 4.0.9, 3.4.12 and 3.3.13, which fix the regular expression engine bugs behind the GitLab issue and three related GitLab CVEs.
  • October 28: Cisco published an advisory for the ASA and FTD SSL VPN bug, rated High with a CVSS base score of 8.6, and said it was aware of active exploitation in October.
  • October 29: CISA added the GitLab and Cisco bugs, both due November 1.
  • October 30: CISA added the two new Ivanti bugs in catalog version 2026.10.30 and updated its Ivanti alert to cover all three Connect Secure CVEs and a revised list of affected versions.
CVEProductAdded to KEVFederal due dateForensic triage
CVE-2026-111357Ivanti Connect SecureOct 30Nov 2Yes
CVE-2026-118527Ivanti Connect SecureOct 30Nov 13No
CVE-2026-97229GitLab CE/EEOct 29Nov 1Yes
CVE-2026-76418Cisco Secure Firewall ASA and FTDOct 29Nov 1No

For all four, the catalog lists known ransomware use as “Unknown.”

Ivanti Connect Secure: a chain, not a single bug

CISA’s catalog entries say each of the two new Ivanti bugs “can be chained with” CVE-2026-104935 and the other. CISA’s alert, last revised October 30, says threat actors are exploiting the three together, which “allows remote, unauthenticated execution of arbitrary commands,” to steal credentials and exfiltrate data. Affected versions are Connect Secure 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior. CISA tells organizations to update to the latest version as set out in Ivanti’s security advisory for CVE-2026-104935, and points to Ivanti’s 25.x upgrade and migration compatibility guide.

Two details in the alert matter more than the patch itself. First, CISA says Ivanti’s Integrity Checker Tool “may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory.” Organizations that want to know whether they were compromised “will need to conduct network and memory forensics.” A clean result from the vendor’s checker is not proof of a clean appliance.

Second, if you suspect compromise, CISA recommends Ivanti’s recovery procedure:

  1. Back up the appliance configuration.
  2. Factory reset the appliance and upgrade it to the latest version. For cloud and virtual systems, rebuild the instance and upgrade.
  3. Restore the configuration from the backup.
  4. Reset passwords for all accounts, including domain, administrator and local accounts. Revoke and reissue stored certificates. Reset stored API keys and license server credentials.

CISA also says Connect Secure 22.8 reaches end of life on January 31, 2027, and recommends Volexity’s write-up, “A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days.” We could not load Ivanti’s own advisory page when checking this piece, so the version and recovery details above are as CISA states them.

GitLab CVE-2026-97229: really a Ruby bug

GitLab’s advisory says the flaw “could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration.” Affected versions are 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. Only self-managed installs are exposed. GitLab published six threat detections for self-managed customers, with names such as “Onigmo native worker crash” and “ci lint workhorse worker crash.”

The root cause is in Onigmo, the regular expression engine inside Ruby. The Ruby project’s October 23 post says GitLab compiles user-supplied patterns with Regexp.new, and that crafted patterns “could corrupt memory while Ruby compiles them.” GitLab assigned four CVEs to related bugs: CVE-2026-89078 and CVE-2026-93577 (fixed in GitLab 19.4.1), CVE-2026-97229 (19.4.2) and CVE-2026-110264 (19.5.1). Patching for this one CVE is not enough if you are still below 19.5.1.

CISA’s catalog note goes further: “Other products can potentially be affected by the same underlying Ruby/Onigmo Integer Overflow issue.” Ruby says the bugs are reached only when an application compiles a regular expression from attacker-controlled input, through Regexp.new, Regexp.union, Regexp.compile or interpolation into a literal. Ruby also says Regexp.timeout does not protect against them, and neither does limiting pattern length. Ruby 4.0.9, 3.4.12 and 3.3.13 contain all the fixes.

Cisco ASA and FTD: VPN outage risk

Cisco’s advisory describes a bug in the Remote Access SSL VPN service of Secure Firewall ASA and Secure Firewall Threat Defense software. An unauthenticated, remote attacker can send a crafted request while connecting and force the device to reload. Cisco says “a successful VPN login is not required to reach the affected processing path.”

The exposure is narrower than the headline suggests. A device is affected only if it runs a vulnerable release, the SSL VPN login is reachable, and secondary authentication is configured at tunnel-group scope, including on the default group, DefaultWEBVPNGroup. Cisco says there are no workarounds, but there is a mitigation: remove secondary authentication, or disable the tunnel group list if the default group does not use it. Both lower your security posture or change how users log in. First fixed releases include ASA 9.18.4.96, 9.20.4.50, 9.22.3.200 and FTD 7.2.13, 7.4.9 and 7.6.7; the full table is in the advisory.

What it means for CFOs and CISOs

For a CISO, the Ivanti entries change the question from “are we patched?” to “were we compromised before we patched?” An appliance that was internet-facing and unpatched after October 13 should be treated as a possible breach, and the recovery steps above are a project: an appliance rebuild, a reset of every account the device touched, and reissued certificates.

For a CFO, that project has a cost, in staff time or in an outside forensics bill, and it can land on short notice. The 22.8 end-of-life date of January 31, 2027 is a second cost. If you run 22.8, a migration to 25.x is coming whether or not you were hit, and it belongs in the budget and the renewal tracker now. The GitLab and Ruby item is a supply-chain question: which of your vendors ship Ruby applications that accept user-written patterns?

The federal due dates bind federal civilian agencies under BOD 26-04, not private companies. They are still a fair benchmark for a board or an insurer asking how quickly you responded.

What to do this week

  1. Ivanti. List every Connect Secure instance and its version. Upgrade per Ivanti’s advisory. If an instance was exposed and unpatched after October 13, run the CISA recovery steps and do not rely on the Integrity Checker Tool alone.
  2. GitLab. Upgrade self-managed GitLab to a fixed release, and to 19.5.1 or later to cover CVE-2026-110264. Check logs against GitLab’s six published detections.
  3. Ruby. Ask your developers and key vendors whether any Ruby application compiles user-supplied patterns, and whether it runs Ruby 4.0.9, 3.4.12, 3.3.13 or later. Log open answers in a risk exception register with an owner and an expiry.
  4. Cisco. Check whether any tunnel group, including DefaultWEBVPNGroup, uses secondary authentication. If it does, upgrade, or apply the mitigation as a stopgap.
  5. Calendar. Put January 31, 2027 for Connect Secure 22.8 in the software renewal scorecard.

End-of-life dates at renewal. A forced migration is easiest to price before the contract renews. The Renewal Audit reviews up to 25 software renewals for a fixed $199 and returns a written report in 5 business days. If you would rather run it yourself, the Renewal & Risk Operator Pack ($29) has spreadsheet versions of the renewal scorecard and the risk exception register. To get KEV additions like these in a weekly digest, the free Grok Bot prompt pack includes a report-only CISA KEV digest routine.

What to watch next

Watch whether CISA or Ivanti publish further indicators for the Connect Secure chain, and whether the ransomware field changes from “Unknown” to “Known.” Watch for vendors outside GitLab naming the Ruby regex fixes in their own advisories. Watch whether Ruby requests its own CVE identifiers; its post says it has not, for now. And watch the November 13 due date for CVE-2026-118527, the last of this group.

Sources

Related: CISA added Magento and a compression library, the previous catalog roundup, and Security and vulnerabilities, every security briefing, guide and tool in one place.

ES
Emilio Santos edits Circuit & Capital. How we source and correct pieces: editorial standards.
circuits50capital@circuits.fit