Friday's show had two deadlines that land this weekend, both set by CISA yesterday. Here is the longer version of the five, with the version numbers, KB numbers and links that do not fit in three minutes.
Cisco firewall VPNs: patched by Sunday
Attackers are crashing Cisco Secure Firewall devices, the ASA and Firepower Threat Defense lines, by sending a crafted request to the remote access SSL VPN service. No sign-in is needed, and the device reloads, which drops every VPN user on it. Cisco's advisory confirms exploitation in the wild and says there are no workarounds, per BleepingComputer's coverage, which also notes the flaw applies when secondary authentication is configured on a tunnel group, and that fixed releases are out, including ASA 9.24.10.1 and FTD 10.1.1. CISA added CVE-2026-76418 to its Known Exploited Vulnerabilities catalog on October 29 with a federal due date of November 1, a three-day window instead of the usual three weeks. It is the second Cisco firewall VPN flaw exploited as a zero-day since August.
Microsoft fixed the Smart App Control switch, for two of three versions
After the October 13 update KB5127648, Windows 11 machines that had Smart App Control turned off could not turn it back on; the option sat grayed out. Microsoft's support page now says: "This issue was resolved for Windows 11, versions 26H2 and 25H2, by Windows updates released on and after October 27, 2026", naming KB5127936. Windows 11, version 24H2 is not in that fix: for it, the same page offers a registry edit or a downloadable Group Policy as the workaround. Machines that already had Smart App Control on were never affected.
Exchange: Outlook on the web sign-in, day seventeen
Since the October 13 Windows Server updates, Microsoft says: "Users might be unable to sign in to OWA or send emails on Exchange Server". OWA is Outlook on the web. Windows release health still lists it as Mitigated, a workaround but no fix, and it covers Windows Server 2016, 2019, 2022 and 2025. If you run your own Exchange server, read that entry before this weekend's patch window.
The install watch: quiet again
Microsoft posted no new "this update fails to install" issues this week; the only known-issue changes were updates to the Remote Desktop 0xC000000D and Smart App Control entries above. A quiet week means a failed install on your machine is more likely local than a known problem. If one fails, note the error code before calling IT.
GitLab: a 10 out of 10, patched since October 12, now exploited
GitLab is where many development teams keep their source code, and CVE-2026-97229 is rated the maximum CVSS 10.0: an unauthenticated attacker can run code on the server through a crafted regular expression in a CI/CD configuration, a flaw in Onigmo, the regular expression engine inside Ruby. GitLab published fixed versions on October 12: 19.4.2, 19.3.5 and 19.2.8. Rapid7 reproduced code execution on an unpatched instance that same week. Yesterday CISA added it to the exploited list with the same Sunday, November 1 due date. GitLab.com itself is already patched; self-managed instances are the ones that need the update.
If you do three things this week
- Ask IT whether the Cisco firewall is on a fixed release, before Sunday.
- If you run self-managed GitLab, update to 19.4.2, 19.3.5 or 19.2.8 today.
- If you run Exchange, read Microsoft's OWA entry before you patch the server this weekend.
Clay in the Morning is Senserva's weekday patch and security show; this is its written companion. The sources behind our trackers, and their terms, are on our Data sources & thanks page.