Exploited CVEs Oct 26-Nov 1, 2026: Cisco, GitLab, Ivanti

Nine CVEs from eight vendors entered the CISA KEV catalog between October 26 and November 1, 2026, according to VulnTracker, and several of them are pieces of larger attacks rather than stand-alone bugs. PHP2Shell and a Linux kernel flaw were chained to root firewalls, Ivanti's root escalation was the last step of a three-exploit chain, and a VMware ESX logging flaw rated 2.7 was used to cover tracks. Scores run from 2.7 to 10.0 and EPSS from 0.5% to 100%. The federal due dates split into six three-day deadlines and three 14-day ones, and the fields VulnTracker shows do not explain which entry got which. We covered each of these in its own post this week, and this is the week in one place.

Monday, October 26: PHP2Shell

CISA added CVE-2026-109618 and CVE-2026-109619, the two PHP flaws known as PHP2Shell, with a due date of October 29. PHP patched both on October 21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CVE-2026-109618 comes from PHP leaving memory corrupted when it runs out of memory and aborts a request, and CVE-2026-109619 is stale global state left after a fatal error. VulnTracker scores them 9.8 Critical and 8.1 High, both with EPSS at 100%.

Attempts began before the patches: Amazon's honeypots logged one on October 17. On October 24 a Perplexity researcher confirmed code execution against a honeypot running Apache mod_php on PHP 8.4.26. The bugs also sit inside products. Palo Alto Networks lists the PAN-OS management web interface and XML API on PA-Series, VM-Series and Panorama, with hotfixes scheduled through October 30, and Siemens lists RUGGEDCOM APE1808 devices running PAN-OS.

Tuesday, October 27: Adobe Commerce and Google Brotli

CVE-2026-48356, known as PolyShell, is an unrestricted file upload in Adobe Commerce and Magento, scored 9.3 Critical with EPSS at 45%. Adobe shipped the fix in bulletin APSB26-73 on July 14, and Sansec had documented attacks since March 19, so CISA's listing came 105 days after the patch. The fixed builds carry the 2026-jul suffix.

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder, also called Node2Shell, fixed on October 21 in Brotli 1.0.10, 1.1.1 and 1.2.1. VulnTracker now shows 9.8 Critical with EPSS at 83% and lists about 25 products from 16 vendors, among them p7zip, brotli and Bun, because the decoder is bundled in so much software. Exploitation is narrower than the score suggests: ELLIO logged exploit traffic against Node.js 24.22.0 on October 26, and the observed chain never completed a command in its own testing. Both entries are due November 10.

Wednesday, October 28: Linux kernel and VMware ESX

CVE-2026-46300, a Linux kernel flaw nicknamed Fragnesia, scores only 7.8 with EPSS at 16% and has been public since May 23. CISA's entry explains the listing: the flaw can be chained with PHP2Shell to implant PHP webshells and run commands as root. A Dream Research report published October 26 describes that chain against 25 servers, all internet-facing firewalls from a vendor it does not name, with root reached in under 15 minutes from one unauthenticated request. The due date is October 31. Fixed upstream kernels include 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10, and distributions ship their own builds.

CVE-2026-41709 is an insufficient logging flaw in VMware ESX, rated 2.7 Low with EPSS at 0.7%. Broadcom fixed it in advisory VMSA-2026-0006 on July 29 and described only that a malicious administrator could perform operations without them being logged. CrowdStrike's report, published the same day as the KEV entry, says the China-nexus group it tracks as WARP PANDA exploited it as a zero-day as late as early 2026. Its due date is November 11.

Thursday and Friday, October 29-30: Cisco, GitLab and Ivanti

CVE-2026-76418 is a denial of service in the SSL VPN service of Cisco Secure Firewall ASA and FTD, scored 8.6 High with EPSS at 0.8%. An unauthenticated attacker can send a crafted request that reloads the device when secondary authentication is configured on a tunnel group, and Cisco says it learned of exploitation in October. The advisory is dated October 28, one day before the KEV entry. The check that matters is the configuration, including DefaultWEBVPNGroup, not only the version. Due November 1.

CVE-2026-97229 is an integer overflow in GitLab's CI/CD regular expression compiler that leads to unauthenticated code execution, scored 10.0 Critical with EPSS at 27%. GitLab patched it on October 12 in 19.4.2, 19.3.5 and 19.2.8. Alpine Linux disclosed failed exploitation attempts against its own GitLab on October 20 to 21 and October 25 to 26, and reports that a plain GitLab version bump did not fix its instance because the fix sits in Ruby, which GitLab applies only in its own packages. Due November 1.

CVE-2026-111357 is the root escalation step of a three-exploit chain that Volexity saw in use from October 3 against Ivanti Connect Secure, including on a fully patched appliance. It scores 7.0 High with EPSS at 0.5%. Ivanti's fix, reported as 25.1.1.3 and 22.8R2.6, arrived on October 29, and the KEV entry followed on October 30 with a due date of November 2.

Same SSVC tags, different deadlines

The due dates split cleanly into two bands, and nothing VulnTracker shows predicts which band an entry lands in. Six entries got three days: the two PHP2Shell CVEs, the Linux kernel flaw, Cisco, GitLab and Ivanti. Three got 14 days: Brotli, Adobe Commerce and VMware ESX.

SSVC does not separate them. CVE-2026-109618, CVE-2026-109619, CVE-2026-46300 and CVE-2026-111357 all read Active, Not automatable, Total impact and got three days. CVE-2026-111497 and CVE-2026-48356 carry the same three tags and got 14. Scores do not separate them either: the 9.8 Brotli bug and the 9.3 Adobe bug got the longer window, while Cisco's 8.6 and Ivanti's 7.0 got the shorter one. Patch age does not help, because both bands hold entries fixed a day before listing (Cisco, Ivanti) and entries fixed months earlier (Adobe at 105 days, VMware at 91, the kernel flaw public for 158).

CISA's BOD 26-04, issued on June 10, 2026, sets federal deadlines from four inputs, according to Tenable and the Cloud Security Alliance: whether the asset is publicly exposed, whether the CVE is on KEV, whether an attacker can automate it, and whether it gives total or partial control. Exposure is the one input each agency decides for itself, and Tenable notes that removing a system from public exposure moves it to a longer timeline. Neither explainer says how CISA picks the date printed on each KEV entry, and the Cloud Security Alliance notes that public reporting does not say which inputs drove a given deadline. The directive binds federal agencies only.

The practical reading is that a due date is a federal timeline, not a ranking of which bug is worse. A 2.7 VMware logging flaw and a 9.8 library bug share the longer window, and the entries with the shortest window include a 7.0. For your own estate, the input that decides order is the one the directive leaves to each agency: what is exposed.

Reading it on VulnTracker

This is how the nine records look on VulnTracker for October 26 to November 1, newest KEV entry first.

CVE	Product	Score	EPSS	KEV added	Due	SSVC
CVE-2026-111357	Ivanti Connect Secure	7.0 High	0.5%	Oct 30	Nov 2	Active, Not automatable, Total
CVE-2026-76418	Cisco ASA and FTD	8.6 High	0.8%	Oct 29	Nov 1	Active, Automatable, Partial
CVE-2026-97229	GitLab CE and EE	10.0 Critical	27%	Oct 29	Nov 1	Active, Automatable, Total
CVE-2026-41709	VMware ESX	2.7 Low	0.7%	Oct 28	Nov 11	Active, Not automatable, Partial
CVE-2026-46300	Linux kernel	7.8 High	16%	Oct 28	Oct 31	Active, Not automatable, Total
CVE-2026-111497	Google Brotli decoder	9.8 Critical	83%	Oct 27	Nov 10	Active, Not automatable, Total
CVE-2026-48356	Adobe Commerce and Magento	9.3 Critical	45%	Oct 27	Nov 10	Active, Not automatable, Total
CVE-2026-109618	PHP, PAN-OS	9.8 Critical	100%	Oct 26	Oct 29	Active, Not automatable, Total
CVE-2026-109619	PHP, PAN-OS	8.1 High	100%	Oct 26	Oct 29	Active, Not automatable, Total

All nine show SSVC exploitation as Active, so SSVC and KEV agree this week, which was not true for the Plex rows the week before. EPSS spans 0.5% to 100%, and the three entries below 1% are Ivanti, Cisco and VMware, all edge or infrastructure products with vendor or researcher reports of real attacks. For fresh KEV entries a low EPSS mostly means the model has not caught up, so go by the KEV flag.

Check which CVSS version a number comes from before comparing. Brotli's 9.8 is a CVSS 3.1 figure while Google's own CVSS 4.0 score is 9.2, Adobe lists PolyShell at 9.6 against VulnTracker's 9.3, and coverage of the Ivanti flaw cites an 8.8 attributed to Ivanti against the 7.0 shown here. The Cisco, Ivanti and GitLab remediation guides are empty, so take fixed versions from the vendor advisories listed below.

What to do

Start with what is internet-facing and already past due, then work toward the November 10 and 11 entries. Five of the six three-day deadlines have passed, and Ivanti's falls on November 2.

Cisco ASA and FTD. Check the running configuration for SSL VPN on an interface and a secondary-authentication-server-group in any tunnel group, including DefaultWEBVPNGroup, then upgrade to Cisco's first fixed release for your train (for example 9.18.4.96 on ASA 9.18 or 7.4.9 on FTD 7.4).
Ivanti Connect Secure. Upgrade to 25.1.1.3 or 22.8R2.6 after confirming in Ivanti's advisory, and do not treat a clean Integrity Checker result as proof of safety, because Volexity says the tool does not detect this activity. Look back to October 3 for welcome.cgi anomalies and for use of the appliance's directory service account.
GitLab. Upgrade self-managed instances to 19.4.2, 19.3.5, 19.2.8 or later. If you run your own image or a non-GitLab Ruby, confirm Ruby is 4.0.9, 3.4.12, 3.3.13 or later, and review logs from October 13 for repeated worker crashes, 502 errors and failed CI jobs.
PHP and PAN-OS. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart workers, keep session.upload_progress.enabled=0 until the follow-up fix lands, restrict PAN-OS management access to trusted addresses and install Palo Alto's hotfix for your release.
Linux kernel. Install your distribution's fixed kernel and reboot, and patch PHP on the same hosts, since the two together are the chain CISA describes. Ask appliance vendors for both statuses.
Brotli. List every runtime, container image and client that decodes Brotli data, update to the fixed releases (Node.js 22.23.4, 24.22.1 or 26.12.1, Bun 1.4.4, Python Brotli 1.2.1) and rebuild images that carry their own copy. Node.js 20, 23 and 25 get no fix.
Adobe Commerce and Magento. Install the July 2026 release for your line, look for .php, .phtml or .phar files in pub/media/custom_options/ and for injected scripts in the cms_block table, and rotate database and admin credentials after cleanup.
VMware ESX. Update to ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389 or Cloud Foundation 5.2.4 as Broadcom's matrix specifies, and send ESXi and vCenter syslog to a collector off the host so log gaps can be compared against an independent copy.

Takeaway

This week's list is easier to use as a set of relationships than as nine rows. A PHP bug and a kernel bug together give root, an Ivanti escalation completes a chain that worked against a patched appliance, and a 2.7 logging flaw hid activity in intrusions that began months before the patch. The due dates will not sort that out for you, since identical SSVC tags landed in both the three-day and 14-day bands. Ask what is internet-facing, what runs together on the same host, and which fixes are already out.

To follow how these nine records change as scores, SSVC fields and remediation guides fill in, add them to your Track List on VulnTracker.