Ivanti Connect Secure Zero-Days Added to CISA KEV

Ivanti Connect Secure zero-days hit the KEV catalog

The headline for the end of the week is Ivanti Connect Secure. CISA added two flaws to the Known Exploited Vulnerabilities catalog on 2026-10-30: CVE-2026-111357, a missing authentication for a critical function (CVSS 7.0), and CVE-2026-118527, generation of predictable numbers or identifiers (CVSS not yet scored). Cyber Security News reports these are being exploited in the wild to gain unauthenticated root access, so this is patch now, not patch eventually.

If you run Connect Secure at your edge, treat it as potentially compromised until you have patched and reviewed it. Unauthenticated root access on a VPN appliance is the kind of foothold that leads straight to lateral movement inside your tenant.

The rest of this week's KEV adds: GitLab, Cisco ASA and FTD

On 2026-10-29, CISA added CVE-2026-97229, an integer overflow or wraparound in GitLab Community and Enterprise Edition, carrying a perfect CVSS 10.0. SecurityWeek reports it is being exploited against Alpine Linux, and Cyber Security News confirms active attacks. It is the number five hot mover and sits on the KEV list now.

CISA also added CVE-2026-76418, an unchecked return value leading to a NULL pointer dereference in Cisco Secure Firewall ASA and FTD software (CVSS 8.6). Another edge device, another reason to prioritize your firewall and VPN inventory this week.

Ransomware-linked and high-EPSS movers to watch

Two KEV entries in the hot list are tied to ransomware actors, which raises the stakes. CVE-2026-63077, a JetBrains TeamCity deserialization flaw (CVSS 9.8, EPSS 0.9356), and CVE-2026-35273, an Oracle PeopleSoft Enterprise PeopleTools missing authentication flaw (CVSS 9.8, EPSS 0.9668), are both ransomware-linked and KEV-listed. If either is in your estate, move them to the front.

The PHP php2shell pair, CVE-2026-109618 and CVE-2026-109619, remain the top two hot movers with maximum EPSS and heavy discussion. Palo Alto confirmed active php2shell exploitation targeting exposed PAN-OS management interfaces, so if your PAN-OS management plane is reachable from the internet, lock it down. CVE-2026-46300, a Linux kernel flaw CISA flagged as exploited, is also on the KEV list.

What the trusted press adds

Two TeamViewer writeups, from Cyber Security News and SecurityWeek, cover CVE-2026-111585, a flaw that could let a malicious host take over a support technician's machine during a remote session. If your help desk uses TeamViewer, review it.

Microsoft's security blog published two pieces worth reading: an analysis of a malicious Claude Code-branded extension with a persistent SSH backdoor, and an investigation into help desk impersonation leading to AD CS abuse through ESC1 and ESC8 intrusion paths. Cisco Talos, via Help Net Security, describes fake IT help desk callers who succeeded with little more than names and email addresses. The vishing and help desk theme is consistent across all three.

On the operations side, Microsoft fixed Remote Desktop connection failures introduced by recent updates through KB5124010, which matters if your users hit RDP problems after patching.

Do this first

Here is the short list grounded in today's facts.

• Patch Ivanti Connect Secure for CVE-2026-111357 and CVE-2026-118527 immediately, then check for signs of root-level compromise.
• Patch GitLab for CVE-2026-97229 (CVSS 10.0, exploited) and Cisco ASA/FTD for CVE-2026-76418.
• Prioritize the ransomware-linked KEV entries CVE-2026-63077 (TeamCity) and CVE-2026-35273 (Oracle PeopleSoft).
• Restrict PAN-OS management interface exposure given active php2shell exploitation, and review TeamViewer use for CVE-2026-111585.
• Confirm your Windows rollups are current; this cycle's hot KBs KB5046615, KB5046612, KB5046617, and KB5046616 each carry KEV-listed CVEs.
• Use the free Senserva non-Microsoft exploited-CVE tracker to follow these KEV additions, and the Microsoft Patch Tracker to rank your open Windows patches by KEV, EPSS, and ransomware linkage.

Sources

• CISA Cybersecurity Advisories: CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-10-30)
• CISA Cybersecurity Advisories: CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-10-29)
• Cyber Security News: Ivanti Connect Secure 0-Days Exploited in the Wild to Gain Unauthenticated Root Access (2026-10-30)
• Cyber Security News: CISA Warns of GitLab Integer Overflow Vulnerability Exploited in Attacks (2026-10-30)
• SecurityWeek: Max-Severity GitLab Vulnerability Exploited Against Alpine Linux (2026-10-30)
• Cyber Security News: Palo Alto Confirms Active PHP2Shell Exploitation Targeting Exposed PAN-OS Management Interfaces (2026-10-30)
• Cyber Security News: CISA Warns of Linux Kernel Missing Initialization Vulnerability Exploited in Attacks (2026-10-30)
• Cyber Security News: TeamViewer Security Flaw Could Turn Remote Support Sessions Into Computer Takeovers (2026-10-31)
• SecurityWeek: TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines (2026-10-30)
• Microsoft Security Blog: From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths (2026-10-30)
• Help Net Security: Fake IT help desk callers got by on little more than names and email addresses (2026-10-30)
• Microsoft Security Blog: Inside a malicious Claude Code-branded extension and its persistent SSH backdoor (2026-10-31)
• Cyber Security News: Microsoft Fixes Remote Desktop Connection Failures Following Recent Updates (2026-10-30)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-31.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.