# MSP Threat Briefing: October 31, 2026

_October 31, 2026 · LNX Inc._

CISA lists two more Ivanti Connect Secure flaws, a CVSS 10 GitLab bug and a Cisco ASA VPN crash as exploited. Federal deadlines start November 1.

CISA added four flaws to its exploited list on October 29 and 30. Two complete an Ivanti Connect Secure attack chain that ends in root and stolen domain credentials. The other two hit self-managed GitLab and Cisco firewall VPNs. Federal deadlines for three of them fall between November 1 and November 2.

1. Upgrade Ivanti Connect Secure to 25.1.1.3, 25.1.3.1 or 22.8R2.6. If the appliance was exposed in October, treat it as compromised and investigate.
2. Upgrade self-managed GitLab to 19.4.2, 19.3.5, 19.2.8 or later, and check its threat detections.
3. Upgrade Cisco ASA and FTD firewalls that run SSL VPN with secondary authentication. Use Cisco's mitigation if you cannot patch this weekend.
4. Upgrade Drupal Commerce Core and audit recent orders.

## 1. Ivanti Connect Secure: the rest of the exploit chain is patched and on the CISA list

CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog on October 30 ([CISA alert](https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog)). The federal due date for [CVE-2026-111357](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111357) is November 2, and CISA requires forensic triage for it. [CVE-2026-118527](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-118527) is due November 13.

Both chain with CVE-2026-104935, an authentication bypass CISA listed on October 13. Volexity [documented the chain](https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/) against a customer appliance starting October 3. It tracks the actor as UTA0576. The appliance was fully patched when it was hit.

- CVE-2026-104935 lets an unauthenticated attacker run code on the appliance.
- CVE-2026-111357 is a missing-authentication flaw that raises the attacker to root. Volexity's October 29 update says Ivanti patched it that day.
- CVE-2026-118527 lets an authenticated attacker write files with their own content to a known location on disk.

What the attacker did matters more than the bugs. Volexity says it pulled LDAP domain credentials stored on the appliance and queried Active Directory. It searched for LAPS passwords and BitLocker recovery keys, ran Kerberos tooling and sprayed passwords. It also sniffed traffic for credentials and edited the appliance's logs. No web shell or backdoor was left behind.

Ivanti's Integrity Checker Tool did not detect the compromise, according to both Volexity and [CISA](https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerabilities-ivanti-connect-secure). The attacker's changes lived only in memory.

**Who is exposed.** Any client with an Ivanti Connect Secure VPN on the internet. CISA lists affected versions as 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior. That includes appliances patched for CVE-2026-104935 earlier this month.

**What to do.**

- Upgrade to 25.1.1.3, 25.1.3.1 or 22.8R2.6. These are the first fixed releases per the [Canadian Centre for Cyber Security](https://cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-1035). Confirm the upgrade path for your branch in [Ivanti's advisory](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US).
- Do not rely on a clean Integrity Checker result. CISA advises network and memory forensics.
- If compromise is suspected, follow Ivanti's recovery steps as CISA summarizes them. Back up the configuration, factory reset and upgrade, then restore. Reset all account passwords and reissue certificates, API keys and license server credentials.
- Rotate the LDAP or service account the appliance uses to reach Active Directory. Then review AD for password spraying, Kerberoasting and reads of LAPS and BitLocker attributes from the appliance's address.
- Look for lateral movement that starts from the VPN appliance.
- Plan ahead for 22.8: CISA notes it reaches end of life on January 31, 2027.

**Indicators published by Volexity.** Values copied from its report; it lists more on its GitHub.

| Type | Indicator |
|---|---|
| IP address | `108.165.147[.]64` |
| Request path | `/dana-na/auth/url_default/welcome.cgi` |
| Request header | `X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi` |
| Hidden directory | `/data/.icscap/` |
| Process | `dsstatmond` running from `.icscap` (a renamed tcpdump) |
| Files | `/data/.icscap/h.py`, `/tmp/ml.py`, `/tmp/rq5.py`, `/tmp/mk.py`, `/tmp/rr.py`, `/tmp/sp_run.py` |
| Output files | `/tmp/pu.txt`, `/tmp/sp_out.txt`, `/tmp/spray_hits.json` |

Volexity also suggests alerting on high request volumes to `welcome.cgi`, and on an `X-DSCGI-PATH` header that does not match the URL path.

## 2. GitLab CVSS 10 flaw is exploited, with a federal deadline of November 1

CISA added CVE-2026-97229 to its exploited list on October 29 ([CISA alert](https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog)). The [catalog entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-97229) sets a November 1 due date and requires forensic triage.

GitLab fixed it on October 12 in its [critical patch release](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/) and rated it CVSS 10.0. A crafted regular expression in a CI/CD configuration lets an unauthenticated user run code on the GitLab server. It affects GitLab CE and EE from 19.2. The root cause is an integer overflow in Ruby's regular expression compiler.

**Who is exposed.** Clients who run their own GitLab server: software shops, engineering firms and anyone who self-hosts code. GitLab.com and GitLab Dedicated are already patched, per GitLab. Shadowserver tracks nearly 2,800 internet-exposed GitLab CE instances, as [reported by BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-now-exploiting-max-severity-gitlab-flaw-in-attacks/).

**What to do.**

- Upgrade to 19.4.2, 19.3.5, 19.2.8 or later. The release includes database migrations, so single-node servers will have downtime.
- Because CISA flags forensic triage, check unpatched servers before and after upgrading. GitLab published six threat detections for self-managed instances, including "Onigmo native worker crash" and "ci regexp guard rejection".
- Review runner tokens, deploy keys and CI/CD variables on any server that was exposed while unpatched. A GitLab server often holds production credentials.
- If the server does not need to be public, put it behind a VPN.

## 3. Cisco ASA and FTD: exploited flaw crashes SSL VPN firewalls

CISA added CVE-2026-76418 on October 29 with a [November 1 federal due date](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76418). Cisco's [advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75), published October 28, rates it 8.6. An unauthenticated remote attacker can send a crafted request that reloads the firewall. Cisco says "the Cisco PSIRT became aware of active exploitation" in October 2026.

This is a denial of service, not a break-in. A reload still drops the office's internet and every VPN user.

**Who is exposed.** ASA or FTD firewalls with all three of these: `webvpn` enabled on an interface, the SSL VPN login reachable, and `secondary-authentication-server-group` set on a tunnel group. Cisco says a successful login is not needed to reach the bug. If `tunnel-group-list enable` is on, check every tunnel group. If not, check only DefaultWEBVPNGroup. Cloud-delivered Firewall, cdFMC, Secure Access and Secure FMC are not affected.

**What to do.**

- Upgrade. First fixed ASA releases: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 or 9.24.10.1. First fixed FTD releases: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1.
- Cisco lists no workaround, but offers a mitigation. If DefaultWEBVPNGroup does not use secondary authentication, run `no tunnel-group-list enable`. Users then have to know their connection profile name.
- If DefaultWEBVPNGroup does use secondary authentication, the mitigation is `no secondary-authentication-server-group`. Cisco notes this weakens VPN security, so treat it as short-term.
- Watch for unexpected reloads in firewall monitoring. Cisco published no indicators.

## Quick hits

**Drupal Commerce Core is exploited.** Drupal's [SA-CONTRIB-2026-254](https://www.drupal.org/sa-contrib-2026-254), published October 28, rates CVE-2026-118539 highly critical. It is an access bypass, and Drupal says "This vulnerability is being actively exploited in the wild." It affects versions before 2.41 and 3.x before 3.3.13. Upgrade to 3.3.13 or 8.x-2.41. Drupal also says to audit orders for inconsistencies.

**The GitLab regex bug also affects other Ruby apps.** Ruby's [October 23 note](https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves) says any app that compiles a regular expression from untrusted input can hit the same bugs. Apps that only use regexes written by their own developers are not affected. `Regexp.timeout` does not help. Ruby 4.0.9, 3.4.12 and 3.3.13 carry all the fixes. Ask clients with custom Ruby or Rails apps to check their runtime version.

## Sources

- [CISA: two known exploited vulnerabilities added, October 30, 2026](https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [CISA: two known exploited vulnerabilities added, October 29, 2026](https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [CISA Known Exploited Vulnerabilities catalog: CVE-2026-111357](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111357)
- [CISA Known Exploited Vulnerabilities catalog: CVE-2026-118527](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-118527)
- [CISA Known Exploited Vulnerabilities catalog: CVE-2026-97229](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-97229)
- [CISA Known Exploited Vulnerabilities catalog: CVE-2026-76418](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76418)
- [CISA: patching guidance for Ivanti Connect Secure, revised October 30, 2026](https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerabilities-ivanti-connect-secure)
- [Volexity: chained exploitation of Ivanti Connect Secure zero-days](https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/)
- [Canadian Centre for Cyber Security: AV26-1035, Ivanti security advisory](https://cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-1035)
- [Ivanti security advisory: Connect Secure](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US)
- [GitLab critical patch release 19.4.2, 19.3.5, 19.2.8](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/)
- [Ruby: regexp fixes for GitLab CVEs](https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves)
- [BleepingComputer: GitLab flaw now exploited](https://www.bleepingcomputer.com/news/security/hackers-now-exploiting-max-severity-gitlab-flaw-in-attacks/)
- [Cisco advisory: ASA and FTD SSL VPN tunnel denial of service](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75)
- [Drupal SA-CONTRIB-2026-254: Commerce Core](https://www.drupal.org/sa-contrib-2026-254)