Joseph Sahr Sellu / security & systems
← All editions
Patch Priority

What to patch first. Every weekday morning.

Edition No. 1 ·

A GitLab flaw rated 10 out of 10 — and a firewall that reboots on request.

Two vulnerabilities joined CISA's exploited list on October 29, and both carry a federal remediation deadline of Sunday, November 1. One can let an unauthenticated attacker run code on a self-managed GitLab server. The other lets an unauthenticated attacker force a Cisco firewall to reload through its VPN login page. Patch GitLab first: it is code execution on the server, so check for compromise as well as patching. If your Cisco VPN gateway is exposed, patch it the same day.

By Joseph Sahr Sellu, vulnerability management practitioner.

Reading time: about 5 minutes KEV additions: 2 Nearest federal deadline: Sources checked: CISA, Cisco, GitLab reporting, Oct 28–30, 2026

Triage order

Vulnerabilities in the order to fix them
#CVEProductImpactCVSSKEV dueFirst action
1 CVE-2026-97229 GitLab CE / EE, self-managed Unauthenticated code execution 10.0 Upgrade GitLab, then confirm the Ruby runtime is patched
2 CVE-2026-76418 Cisco Secure Firewall ASA / FTD Unauthenticated device reload via SSL VPN 8.6 Upgrade to the first fixed release for your train
01

Patch First

The vulnerabilities that matter today, in the order to fix them. Exploitation status first, everything else second.

CVE-2026-97229 Critical · CVSS 10.0 CISA KEV · Due Nov 1

GitLab: unauthenticated code execution through a crafted CI/CD regular expression

An integer overflow in GitLab's CI/CD regular-expression compiler can, under certain conditions, let an unauthenticated attacker execute arbitrary code on a self-managed GitLab Community Edition or Enterprise Edition server through a specially crafted regular expression in a CI/CD configuration. GitLab assigned the maximum CVSS score of 10.0 and shipped fixes on October 12, 2026. CISA added the flaw to the KEV catalog on October 29, citing evidence of active exploitation. GitLab.com was already patched, and GitLab Dedicated customers do not need to act. The CVSS vector lists no privileges required; GitLab has not published the exact request path, so how an outsider delivers the crafted configuration is not yet public.

Check the Ruby underneath, not just the GitLab version. The underlying flaw sits in Onigmo, the regular-expression engine in Ruby. The Alpine Linux project disclosed that an attacker tried this flaw against its GitLab server on October 20–21; Alpine later found that upgrading GitLab alone had not closed the hole on its own build because its image used a standard Ruby runtime rather than the Ruby bundled with GitLab's official packages. Patched Ruby releases are 3.3.13, 3.4.12, and 4.0.9.

What to do

Upgrade self-managed instances to 19.2.8, 19.3.5, or 19.4.2 for your branch, outside the normal patch cycle. Then verify which Ruby the server actually runs — a GitLab upgrade on a custom Ruby does not by itself apply the fix. This is code execution, so if the server was exposed before you patched, look for signs of compromise as well.

Fixed releases at a glance
  • GitLab CE / EE: 19.2.8, 19.3.5, 19.4.2
  • Ruby (Onigmo): 3.3.13, 3.4.12, 4.0.9

Sources: CISA alert, Oct 29, 2026 · Rapid7 analysis, Oct 2026 · Rapid7 technical analysis · SOCRadar · SecurityOnline, Ruby Onigmo fixes · Alpine / Ruby reporting, Oct 30, 2026.

CVE-2026-76418 High · CVSS 8.6 CISA KEV · Due Nov 1

Cisco Secure Firewall ASA / FTD: one crafted VPN request forces the firewall to reload

Logic errors in the Remote Access SSL VPN service, when secondary authentication is configured on a tunnel group, let an unauthenticated remote attacker send a crafted request while connecting to the SSL VPN and force the device to reload unexpectedly. Every reload drops VPN sessions and traffic passing through the device. Cisco's Product Security Incident Response Team became aware of active exploitation in October 2026; Cisco published fixed releases on October 28, and CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on October 29. No workaround fully addresses it, and Cisco says a successful VPN login is not required to reach the affected code path.

You are exposed only if all three are true: the device runs a vulnerable ASA or FTD release, the SSL VPN login service is reachable (the running configuration contains webvpn with SSL VPN enabled on at least one interface), and secondary authentication is configured on a tunnel group — including the default DefaultWEBVPNGroup. Cisco's cloud-delivered firewall and management offerings, Secure Access, and Secure Firewall Management Center are not affected.

Quick exposure check for one device

Tick each condition that is true for the device.

What to do

Upgrade to the first fixed release for your train now — before the November 1 federal deadline if you are in scope, and on the same urgency if you are not. If you cannot upgrade immediately, Cisco describes disabling secondary authentication on the affected tunnel groups as an exposure-reducing mitigation; it removes an authentication layer, so treat it as a stopgap only, not a fix. Unexplained reloads on an internet-facing ASA or FTD this month are worth checking against the device's crash records.

Fixed releases (Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75)
  • ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27, 9.24.10.1
  • FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3, 10.1.1

Sources: CISA alert, Oct 29, 2026 · CISA KEV catalog · BleepingComputer, Oct 29, 2026 · SecurityWeek, Oct 29, 2026 · Cisco advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75.

02

New & Notable

Significant disclosures, ranked. One to two lines each.

  1. Second Cisco VPN zero-day since August. CVE-2026-20349

    Cisco patched an earlier unauthenticated reload flaw in the same ASA/FTD SSL VPN service in August. Two exploited denial-of-service flaws in the same service in about three months is a pattern worth naming in your next firewall review — and a reason to treat unexplained VPN-gateway reloads as a security signal, not just an availability one. Source: SecurityWeek.

  2. No attribution, no indicators — yet.

    For CVE-2026-76418, Cisco has not named a threat actor, shared indicators of compromise, or described the scale of attacks, and CISA lists known ransomware use as “Unknown.” Patch on the exploitation evidence, not on attribution that has not been published. Sources: CISA KEV catalog; SecurityWeek.

03

Identity Watch

Identity, single sign-on, and authentication.

No new identity-platform advisories verified at press time

No identity or single sign-on advisory was verified against a named source in the last few days, so none is reported here.

This week's Cisco item still belongs in this section: the vulnerable code path is the firewall's secondary authentication handling, reachable before anyone logs in. Every authentication layer you add is also code an attacker can reach, so inventory where your MFA and SSO checks actually run, and patch those components on the same clock as the systems they protect.

04

Automate This

One practical automation idea per edition.

Diff the KEV catalog against your scanner, every morning

Run a daily job that pulls the CISA KEV catalog and compares it with your vulnerability scanner's open findings. Anything that appears in both — and anything already past its federal due date — opens a ticket automatically, routed to the asset owner, with the due date in the title.

  1. Match on CVE ID only; never on product name, which drifts between sources.
  2. Flag KEV entries whose due date has passed as overdue, separately from merely open.
  3. Copy the KEV entry's required action and notes into the ticket, so items that call for a compromise check get one, not just a patch.

A practice tip, not a product claim: build it with whatever scheduler and ticketing tools you already run. The discipline — daily, automatic, CVE-matched — matters more than the tooling.

About the author

Joseph Sahr Sellu is a Security Administrator at Rowan University. His work centers on finding, ranking, and fixing vulnerabilities before they are exploited, with a focus on automating the remediation work and treating identity systems as part of the attack surface. He holds an MS in Cybersecurity from Rowan University and the SSCP, ISC2 CC, and CCNA certifications.

Full profile · CV · LinkedIn · GitHub

Patch Priority is a briefing, not a substitute for your own change control, testing, or vendor guidance. Verify fixed releases against the vendor advisory for your exact product and version before patching.