This edition focuses on firewalls, business software and servers. Cisco confirms that attackers are forcing ASA and FTD firewalls to reboot via the SSL VPN, attackers are probing a critical flaw in Oracle E-Business Suite, a kernel bug in the Linux TCP stack is still awaiting a patch at Ubuntu and Red Hat, and the GitLab flaw with a CVSS score of 10.0 has now been added to the CISA catalogue after Alpine Linux was attacked.
- Cisco ASA and FTD: attackers force firewalls to reboot via the SSL VPN
- Oracle E-Business Suite: critical SQL injection flaw being probed, Horizon3 publishes indicators
- Linux kernel: TCP bug may give root, Ubuntu and Red Hat do not yet have a patch
- GitLab flaw with CVSS 10.0: now actively exploited and added to the CISA catalogue
Cisco ASA and FTD: attackers force firewalls to reboot via the SSL VPN
| Vulnerability | Logic error in Cisco Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software in the Remote Access SSL VPN when secondary authentication is configured on a tunnel group. An attacker without credentials can force the device to reboot (denial of service) |
| CVE number | CVE-2026-76418 |
| CVSS score | 8.6 (high) |
| Actively exploited | Yes, Cisco PSIRT learned of exploitation in October 2026. CISA added the flaw to the KEV catalogue on 29 October 2026 |
| Patch available | Yes. ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1. FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1 |
How can the vulnerability be exploited?
According to the Cisco advisory of 28 October, a specially crafted request when connecting to the SSL remote access VPN is enough. A successful VPN login is not required. A firewall is vulnerable if the VPN login service is reachable and secondary authentication is configured on a tunnel group. This also applies to the default group DefaultWEBVPNGroup. The Hacker News writes that Cisco has not disclosed when the attacks began, who is behind them or how widespread they are. This is already the second time since August that Cisco has fixed an exploited zero-day in the VPN service of these firewalls.
What could the impact be?
As far as is known, this does not lead to data theft or code execution. The attacker can, however, force the firewall to reboot repeatedly, knocking out remote access for all users behind that device. For an MSP that manages the VPN for many SME clients, that means outages at multiple sites at once.
What should IT administrators do now?
Update to one of the fixed releases. If you cannot do so immediately, check the configuration to see whether secondary authentication is set on a tunnel group. If it is, you can disable it temporarily. Cisco regards this as an emergency workaround that weakens VPN security, and for the default group, disabling the tunnel group list only helps if that group does not itself use secondary authentication. In addition, search the logs for unexpected reboots of ASA and FTD devices since the beginning of October.
Oracle E-Business Suite: critical SQL injection flaw being probed, Horizon3 publishes indicators
| Vulnerability | Unauthenticated SQL injection in the Thin Client Framework servlet of Application Object Library in Oracle E-Business Suite 12.2.3 to 12.2.15 inclusive, which can be chained to achieve code execution on the application host |
| CVE number | CVE-2026-101767 |
| CVSS score | 9.8 (critical) |
| Actively exploited | Yes, at least reconnaissance attempts: Defused observed them in its EBS honeypots on 27 October 2026. Oracle reports that attackers succeeded at customers who had not installed the patch |
| Patch available | Yes, in the October 2026 Critical Patch Update (20 October). Temporary mitigation: remove the /OA_HTML/AppsTCFServer servlet from the firewall’s URL allowlist and restrict the web tier to trusted networks |
How can the vulnerability be exploited?
According to Help Net Security, Horizon3.ai researchers Brandon Peterson, Jimi Sebree and Noah King discovered the flaw and reported it to Oracle on 24 July. Oracle describes it as an easily exploitable flaw that is reachable via HTTP. An attacker who can reach the servlet executes SQL as the APPS database user. Horizon3.ai has published indicators of compromise, and Censys counted 2,246 web properties running E-Business Suite. These are hostnames and ports, so the number of unique systems is lower.
What could the impact be?
Depending on the installation, financial data, payroll, HR and procurement data are open to being read and modified. The attacker can then execute commands on the application host. The Critical Patch Update has been out for eleven days, so environments that have not yet applied it are now the target.
What should IT administrators do now?
Check whether clients running Oracle E-Business Suite have installed the October update. Until then, remove the AppsTCFServer servlet from the allowlist and close off the web tier from the internet. Check the web tier and database logs against the Horizon3.ai indicators, particularly for suspicious calls to /OA_HTML/AppsTCFServer since 27 October.
Linux kernel: TCP bug may give root, Ubuntu and Red Hat do not yet have a patch
| Vulnerability | Race condition in the setup of IPv4 TCP connections in the Linux kernel, resulting in a use-after-free. The bug has been in the kernel since version 4.4. IPv6 is not affected |
| CVE number | CVE-2026-98432 |
| CVSS score | 9.8 according to the kernel CVE team. Red Hat, Oracle and SUSE arrive at 5.9 to 8.1 and Amazon at 7.0, because the race is difficult to win |
| Actively exploited | No, no exploitation reported and not in the CISA catalogue (as of 29 October). However, Anthropic has described a working exploit, which is not public |
| Patch available | Partially. Kernels 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3 contain the fix. Debian, Oracle Linux (UEK) and Amazon Linux 2023 have patched. Ubuntu and Red Hat have not yet |
How can the vulnerability be exploited?
When completing a connection, the kernel passes the IP options of the pending request to the new socket without copying them. If that socket is destroyed while another processor core is still using the options, the kernel reads freed memory. According to The Hacker News, Xinyang Ge of Anthropic reported the bug. Anthropic writes that its AI model Claude created a two-stage exploit that first bypasses kernel address randomisation (KASLR) and then executes a command as root, taking roughly 48 minutes plus 5 minutes in the test. The target was a server with an MPTCP listener. Whether disabling MPTCP helps has not been confirmed, as neither the CVE description nor the kernel fix mentions MPTCP.
What could the impact be?
Almost every Linux server running IPv4 falls within the affected ranges. Red Hat primarily expects a kernel crash, but memory corruption, and with it root privileges, is theoretically possible. As of 29 October, Ubuntu 22.04 to 26.10 inclusive are under review and Ubuntu 16.04, 18.04 and 20.04 have no fix. For RHEL 8, 9 and 10 and OpenShift 4, the fix has been deferred. RHEL 7 is not affected. Red Hat does not list any mitigation that meets its own criteria.
What should IT administrators do now?
Install the fixed kernel wherever possible and reboot the system. Draw up a list of servers running Ubuntu, RHEL and Amazon Linux 2, as no patch is available for these yet, and follow the CVE pages of Ubuntu and Red Hat. Until then, block incoming traffic from untrusted networks to non-public services where possible, and put servers running MPTCP at the top of the list.
GitLab flaw with CVSS 10.0: now actively exploited and added to the CISA catalogue
| Vulnerability | Integer overflow in the Onigmo regular expression engine (Ruby) in GitLab Community and Enterprise Edition. A manipulated regex in a CI/CD configuration gives an attacker without credentials code execution on the GitLab server |
| CVE number | CVE-2026-97229 |
| CVSS score | 10.0 (critical) |
| Actively exploited | Yes. CISA added the flaw to the KEV catalogue on 29 October 2026. Alpine Linux observed attack attempts on its own GitLab server on 20 and 21 October |
| Patch available | Yes, GitLab patch of 12 October and patch release 19.4.2. With a custom Ruby, Ruby 3.3.13, 3.4.12 or 4.0.9 (or later) is also required |
Patchwork of Monday 26 October covered a different GitLab flaw with a CVSS score of 10.0 in the same regex engine. Today’s news is that the earlier flaw of 12 October is now being exploited in the wild, and that the GitLab update alone is not always sufficient.
How has this been exploited?
According to Alpine Linux’s incident report, on 13 October the project mistakenly installed GitLab 19.3.4 instead of 19.3.5, which contained the fix. On 20 and 21 October, a newly registered account sent manipulated CI configurations to the server. The GitLab worker processes crashed eight times and in four cases the attacker got a step further, but the next step failed. The attacker also downloaded the GitLab container image, probably to tailor the exploit to the exact build. Alpine found no evidence of code execution but cannot rule it out, and therefore rebuilt the server with new passwords and new secret keys. According to Alpine, a successful attack leaves no crash and no trace in the web logs. Dutch security news site Security.nl also reports on the incident.
What could the impact be?
A successful attack gives an attacker access to password hashes, 2FA secrets, CI/CD variables, runner tokens, personal access tokens and private repositories. For an MSP or development team, it is precisely those CI/CD secrets that are valuable, as they provide access to client environments. The KEV note states that other products may also contain the same underlying Ruby bug.
What should IT administrators do now?
For self-hosted GitLab, check both the GitLab version and the Ruby version. Official GitLab packages and images already include the Ruby fix, but a self-built installation or an image with a custom Ruby needs it, as described in the Ruby announcement. If the server is reachable from outside and was still running a vulnerable version in the days after 12 October, treat it as potentially compromised: replace tokens, secrets and passwords, and search the logs for worker crashes and new accounts.
This article was originally published in Dutch on MSP Business. Read the original →
