Critical Cybersecurity Alert: GitLab, Cisco and Ivanti Vulnerabilities Actively Exploited

Cybersecurity teams are facing another wave of serious security threats as vulnerabilities affecting GitLab, Cisco and Ivanti have been identified as actively exploited in the wild.

Recent additions to the US Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) Catalog highlight a growing concern: attackers are not simply discovering weaknesses in widely used enterprise software. They are already attempting to exploit them.

The vulnerabilities affect critical business infrastructure, including software development environments, network security appliances and remote access systems.

For organizations relying on these technologies, delaying security updates could leave sensitive systems exposed to unauthorized access, service disruption and potentially complete system compromise.

According to CISA's October 29 and October 30 updates, multiple vulnerabilities affecting these vendors were added to its KEV Catalog based on evidence of active exploitation.

What Happened?

The latest security developments involve three major technology providers:

• GitLab: A critical vulnerability could allow unauthenticated attackers to execute arbitrary code on affected GitLab servers.
• Cisco: A vulnerability affecting Secure Firewall products could allow remote attackers to disrupt network security infrastructure.
• Ivanti: Multiple vulnerabilities affecting Connect Secure appliances could enable attackers to bypass security controls, upload malicious files and potentially compromise remote access infrastructure.

These are not ordinary software bugs. They affect systems that organizations depend on to develop software, secure networks and provide employees with remote access.

1. GitLab: Critical Vulnerability Could Allow Remote Code Execution

GitLab has been affected by a critical vulnerability tracked as CVE-2026-97229, involving an integer overflow in its CI/CD regular expression compiler.

The vulnerability affects GitLab Community Edition (CE) and Enterprise Edition (EE).

Under certain conditions, an unauthenticated attacker could exploit a specially crafted regular expression in a CI/CD configuration to execute arbitrary code on the GitLab server.

In simple terms, an attacker may be able to run malicious commands on a vulnerable GitLab server without first having a legitimate account.

Why Is This Dangerous?

GitLab environments often contain sensitive development resources, including private source code, API keys, authentication tokens, CI/CD deployment credentials and access to internal development infrastructure.

If attackers gain control of a GitLab server, they could potentially interfere with development workflows, expose sensitive information or compromise connected systems.

The vulnerability carries a CVSS score of 10.0, the highest possible severity rating.

GitLab released security patches on October 12, 2026, through versions 19.2.8, 19.3.5 and 19.4.2.

CISA subsequently added CVE-2026-97229 to its KEV Catalog on October 29, following evidence of exploitation.

Organizations operating self-managed GitLab installations should upgrade to the appropriate patched version immediately and investigate suspicious activity in their CI/CD pipelines.

2. Cisco: Actively Exploited Firewall Vulnerability Could Disrupt Network Security

Cisco has also disclosed an actively exploited vulnerability affecting its Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software.

Tracked as CVE-2026-76418, the vulnerability exists in the Remote Access SSL VPN service.

It involves a logic error related to secondary authentication configurations on a tunnel group.

An unauthenticated remote attacker could exploit this weakness to cause an affected firewall device to unexpectedly reload.

This results in a Denial-of-Service (DoS) condition, potentially interrupting network connectivity and remote access services.

Why Is This Dangerous?

Firewalls are among the most important components of an organization's security infrastructure. They control network traffic, protect internal systems and help secure remote connections.

If an attacker can repeatedly trigger a firewall restart, an organization could experience disrupted business operations, interrupted VPN connectivity and reduced network availability.

Cisco assigned the vulnerability a CVSS score of 8.6.

Cisco published its security advisory on October 28, 2026. CISA added the vulnerability to its KEV Catalog on October 29 after Cisco confirmed exploitation in the wild.

Administrators should review Cisco's security advisory, identify affected ASA and FTD deployments and install the appropriate security updates. Cisco's advisory indicates that no workarounds are available.

3. Ivanti: Multiple Vulnerabilities Put Remote Access Infrastructure at Risk

Ivanti is facing another serious security situation involving multiple actively exploited vulnerabilities in its Connect Secure appliances.

These appliances are commonly used by organizations to provide secure remote access to internal networks.

CISA's October 30 update identified three vulnerabilities: CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527.

These vulnerabilities involve authentication bypass, missing authentication for a critical function and predictable numbers or identifiers.

They are particularly concerning because attackers can exploit weaknesses in remote access infrastructure to execute unauthorized commands, steal credentials and extract sensitive information.

The vulnerabilities affect Ivanti Connect Secure versions 25.1.1.2 and earlier, 25.1.2.2 and earlier, and 22.8R2.5 and earlier, according to CISA's updated alert.

Why Is This Dangerous?

Remote access appliances provide a connection between employees and an organization's internal network.

If attackers compromise these systems, they may gain opportunities to steal employee and administrator credentials, access sensitive internal resources, extract confidential business information and move further into connected infrastructure.

CISA confirmed that threat actors were exploiting these vulnerabilities and urged organizations to update affected appliances immediately.

It also warned that identifying a compromise may require network and memory forensics. Its alert specifically notes that Ivanti's Integrity Checker Tool may not detect evidence of exploitation involving CVE-2026-104935 because malicious commands can execute in memory.

Organizations should immediately review Ivanti's security advisories and upgrade affected appliances. If compromise is suspected, they should follow Ivanti's recovery procedures, conduct appropriate forensic investigations and reset potentially exposed credentials, certificates and API keys.

Why These Vulnerabilities Matter to Businesses

These incidents highlight an important reality: even widely trusted enterprise technologies can become entry points for cyberattacks.

The affected products serve different purposes, but their compromise can have consequences that extend beyond the vulnerable software itself.

A compromised development platform can expose source code and affect software delivery. A disrupted firewall can interrupt business operations. A compromised remote access appliance can expose internal systems to attackers.

The bigger concern is how interconnected modern business infrastructure has become.

This is why organizations cannot rely solely on software vendors to protect their infrastructure. They must continuously identify vulnerabilities, assess their exposure and verify that security controls are working as expected.

What Should Organizations Do Now?

With multiple vulnerabilities confirmed as actively exploited, organizations should treat remediation as an immediate security priority rather than routine maintenance.

1. Identify Affected Systems

Maintain an updated inventory of GitLab, Cisco and Ivanti deployments. Identify internet-facing systems and determine which versions are vulnerable.

2. Apply Security Patches Immediately

Install the latest vendor-recommended security updates. Prioritize systems listed in CISA's Known Exploited Vulnerabilities Catalog.

3. Investigate Potential Compromises

Patching alone does not guarantee that an organization has not already been compromised. Review system logs, authentication records, network traffic and suspicious administrative activity.

4. Secure Credentials and Access

Rotate potentially exposed passwords, API keys, deployment tokens and other credentials. Review privileged accounts and revoke unauthorized access.

5. Review Network Exposure

Limit unnecessary public access to administrative interfaces, remote access services and development infrastructure. Apply network segmentation wherever possible.

6. Conduct Regular Security Assessments

Perform vulnerability assessments and penetration testing to identify weaknesses before attackers can exploit them.

Organizations should also monitor vendor security advisories and CISA's KEV Catalog for newly confirmed threats.

Conclusion: Being Patched Is Not the Same as Being Secure

The vulnerabilities affecting GitLab, Cisco and Ivanti demonstrate how quickly weaknesses in widely deployed enterprise technologies can become real security threats.

The biggest lesson for organizations is that cybersecurity cannot be treated as a one-time activity.

Installing security updates is essential, but businesses must also understand their attack surface, monitor their infrastructure and continuously test whether their security controls can withstand real-world attacks.

Attackers actively look for weaknesses in systems organizations depend on every day. Businesses need to be equally proactive in finding and fixing those weaknesses.

At Cynical Technology, we believe effective cybersecurity starts with identifying weaknesses before attackers turn them into incidents.

Don't wait for a security incident to discover what your infrastructure is missing.