Cisco ASA Zero-Day and GitLab CVSS 10 Hit CISA KEV

Cisco Secure Firewall ASA zero-day exploited to crash SSL VPN devices

The headline for October 29 is CVE-2026-76418, an unchecked return value leading to a NULL pointer dereference in Cisco Secure Firewall ASA Software and Cisco Secure FTD Software. CISA added it to the Known Exploited Vulnerabilities catalog on October 29, and it carries a CVSS of 8.6. Cyber Security News reports attackers are using it in the wild to crash SSL VPN devices, and SecurityWeek notes this is the second Cisco firewall VPN zero-day exploited since August.

If you run ASA or FTD with SSL VPN exposed, treat this as patch now, not patch eventually. A KEV listing means someone is already using it. Prioritize internet-facing firewalls and confirm whether your appliances are reachable from the outside before you schedule anything else.

GitLab CVSS 10 and three more added to the KEV catalog

CISA also added CVE-2026-97229, an integer overflow or wraparound in GitLab Community Edition and Enterprise Edition, on October 29. It carries a CVSS of 10, the maximum score, and it now sits in the hot CVE list as KEV-flagged. Self-managed GitLab instances should be upgraded immediately.

Two more KEV adds landed on October 28: CVE-2026-41709, an insufficient logging vulnerability in Broadcom VMware ESX (CVSS 2.7), and CVE-2026-46300, a missing variable initialization flaw in the Linux Kernel (CVSS 7.8). The ESX flaw is low-scoring but matters because Cyber Security News and Help Net Security report Chinese actors are using it to hide malicious activity on compromised servers. Low CVSS does not mean low risk when it is already being abused operationally.

PHP2Shell chains stay the hottest exploited CVEs

The top of the hot list is still the PHP php2shell pair, CVE-2026-109618 and CVE-2026-109619, both unauthenticated remote code execution flaws (CVSS 9.8) from the emergency release of October 21. Both are KEV-listed with EPSS at 1.0, and they continue to dominate Hacker News discussion. Cyber Security News reports attackers chained php2shell with Linux kernel exploits to gain root on 25 servers, and Help Net Security ties php2shell and Fragnesia together in firewall root attacks.

Two KEV entries in the hot list are ransomware-linked and deserve the same urgency: CVE-2026-63077, a JetBrains TeamCity deserialization flaw (CVSS 9.8), and CVE-2026-35273, an Oracle PeopleSoft PeopleTools missing authentication flaw (CVSS 9.8, EPSS 0.9668). Ransomware linkage plus KEV is the clearest signal to move first.

What the press adds on espionage and Entra ID

SecurityWeek and Cyber Security News both link Cisco SD-WAN zero-day exploitation (CVE-2026-20127) to Volt Typhoon's Silent Train network, used against U.S. government and defense targets, deploying KeyDrift malware to steal encryption keys. Help Net Security also reports exploitation attempts have begun against the recently patched Oracle E-Business Suite flaw CVE-2026-101767.

On identity, Microsoft is urging Entra ID administrators to migrate away from SMS and voice authentication to passkeys, per Cyber Security News. If you still allow SMS or voice as a factor, now is a good time to plan the phishing-resistant move.

Do this first

Work from the exploitation evidence, not just the scores.

• Patch internet-facing Cisco ASA and FTD for CVE-2026-76418 now; confirm SSL VPN exposure first.
• Upgrade self-managed GitLab for CVE-2026-97229 (CVSS 10, KEV).
• Patch VMware ESX for CVE-2026-41709 and the Linux Kernel for CVE-2026-46300; both are KEV as of October 28.
• Prioritize the ransomware-linked JetBrains TeamCity (CVE-2026-63077) and Oracle PeopleSoft (CVE-2026-35273) fixes.
• Review Entra ID authentication methods and plan the move from SMS and voice to passkeys.
• This month's Windows cumulative updates (KB5046616, KB5046617, KB5046615, KB5046612) are flagged Critical with KEV content; roll them across servers and workstations.
• Senserva's free Microsoft Patch Tracker ranks your open Microsoft patches by KEV, EPSS, and ransomware linkage, and the non-Microsoft exploited-CVE tracker follows these KEV additions daily.

Sources

• Cyber Security News: Cisco Secure Firewall 0-Day Vulnerability Exploited in the Wild to Crash SSL VPN Devices (2026-10-29)
• SecurityWeek: Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August (2026-10-29)
• Cyber Security News: Chinese Hackers Exploit VMware ESXi 0-Day to Hide Malicious Activity on Compromised Servers (2026-10-29)
• Help Net Security: Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls (2026-10-29)
• Cyber Security News: Hackers Chain PHP2Shell and Linux Kernel Exploits to Gain Root Access on 25 Servers (2026-10-29)
• Cyber Security News: Hackers Exploit Critical Cisco SD-WAN 0-Day Flaw to Deploy KeyDrift Malware and Steal Encryption Keys (2026-10-29)
• SecurityWeek: Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network (2026-10-29)
• Cyber Security News: Microsoft Urges Entra ID Admins to Migrate from SMS and Voice Authentication to Passkeys (2026-10-29)
• Help Net Security: Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767) (2026-10-29)
• CISA Cybersecurity Advisories: CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-10-29)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-30.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.