CISA’s Known Exploited Vulnerabilities (KEV) Catalog identifies security vulnerabilities for which exploitation has been observed in the wild. Between 26 and 30 October 2026, ten vulnerabilities were reported as added to the catalog, affecting application runtimes, development platforms, enterprise software, network security appliances and remote-access infrastructure.
The latest additions include two PHP vulnerabilities, Google Brotli, Adobe Commerce, Linux Kernel, VMware ESX, Cisco Secure Firewall, GitLab and two vulnerabilities affecting Ivanti Connect Secure.
These additions deserve attention because KEV inclusion indicates known exploitation. Organizations should establish whether their systems are affected and prioritize remediation accordingly.
1. PHP: Two Vulnerabilities in Memory Management
CVE-2026-109618 and CVE-2026-109619
These vulnerabilities affect PHP’s internal memory management and request-processing paths. The reported issues involve memory corruption and stale internal request state, potentially exposing applications to security compromise.
Organizations running PHP-powered applications should identify affected versions, apply the appropriate security updates and investigate suspicious activity on previously exposed systems.
Related reading: PHP2Shell vs Node2Shell: How Memory-Safety Flaws Lead to Remote Code Execution
2. Google Brotli: An Unchecked Return Value
CVE-2026-111497
This vulnerability concerns an unchecked return value in Google Brotli. Failure to handle an unsuccessful operation correctly can result in unexpected program behaviour and potentially create security consequences.
The impact depends on the affected code path and how applications process compressed data.
Security teams should identify affected Brotli libraries and dependent applications, update vulnerable components and redeploy applications where necessary.
3. Adobe Commerce and Magento: Dangerous File Uploads
CVE-2026-48356
The vulnerability involves unrestricted uploads of files with dangerous types in Adobe Commerce and Magento.
Depending on how uploaded files are stored and processed, this weakness can expose applications to malicious content and potentially more serious compromise.
Administrators should verify affected versions, apply Adobe’s security update and investigate unexpected uploads or suspicious administrative activity.
4. Linux Kernel: Missing Variable Initialization
CVE-2026-46300
This vulnerability involves a variable that is not properly initialized. Such defects can cause unexpected behaviour when software uses a value that has not been set correctly.
Organizations should check affected kernel versions against their Linux distribution’s security advisories and deploy the appropriate updates. A reboot may be necessary to ensure the patched kernel is running.
5. VMware ESX: Insufficient Logging
CVE-2026-41709
This vulnerability concerns insufficient logging in VMware ESX.
Logging weaknesses can make it harder to investigate suspicious activity and reconstruct events during an incident. However, insufficient logging should not automatically be interpreted as a remote code execution vulnerability.
Organizations should follow Broadcom’s remediation guidance and ensure that security monitoring provides adequate visibility into their virtualization infrastructure.
6. Cisco ASA and FTD: SSL VPN Denial-of-Service Vulnerability
CVE-2026-76418 | CVSS 8.6
Cisco Secure Firewall ASA and FTD software are affected by a high-severity denial-of-service vulnerability involving a NULL pointer dereference.
An unauthenticated remote attacker could potentially trigger an unexpected firewall reload by sending a specially crafted request to an affected device. The vulnerability is associated with the Remote Access SSL VPN connection process when secondary authentication is configured for a tunnel group.
A successful attack could interrupt remote access and affect network availability.
Organizations should identify affected firewall versions, verify their SSL VPN configuration and apply the software updates specified in Cisco’s advisory. Unexpected device reloads should also be investigated.
Related reading on TheCyberThrone: Cisco ASA and FTD: High-Severity SSL VPN DoS Vulnerability Disclosed
7. GitLab: Critical Integer Overflow Vulnerability
CVE-2026-97229 | CVSS 10.0
This vulnerability affects GitLab Community Edition and Enterprise Edition. It involves an integer overflow or wraparound issue associated with CI/CD regular-expression processing.
The reported impact includes the potential for unauthenticated remote code execution on vulnerable installations.
A compromised GitLab server could expose source code, pipeline configurations, deployment credentials and connected infrastructure, depending on the attacker’s access and the server’s configuration.
Organizations operating self-managed GitLab instances should identify affected versions, apply the appropriate security update and investigate suspicious activity involving CI/CD pipelines and connected runners.
Related reading on TheCyberThrone: CVE-2026-97229: Critical GitLab Vulnerability Could Allow Remote Code Execution
8. Ivanti Connect Secure: Two New Vulnerabilities
CVE-2026-111357 and CVE-2026-118527
CISA added two additional vulnerabilities affecting Ivanti Connect Secure to the KEV Catalog on 30 October 2026.
The first, CVE-2026-111357, involves missing authentication for a critical function. This means a security-sensitive function may be accessible without the required authentication under the vulnerable conditions.
The second, CVE-2026-118527, concerns the generation of predictable numbers or identifiers. Predictable values can undermine security mechanisms when those values are intended to be difficult to guess.
These additions are particularly relevant because Ivanti Connect Secure provides remote-access capabilities to enterprise environments. Vulnerabilities affecting authentication and security-sensitive functionality in remote-access infrastructure deserve immediate attention.
Organizations should identify affected appliances, consult Ivanti’s security advisories and apply the prescribed updates. They should also review available authentication and appliance logs for suspicious activity.
Reference: CISA Known Exploited Vulnerabilities Catalog
This week’s KEV additions cover application runtimes, compression libraries, e-commerce platforms, operating-system kernels, virtualization infrastructure, network firewalls, development environments and remote-access gateways.
For security teams, the priority is straightforward: establish exposure, remediate affected systems and verify that the fixes are effective.
