Weekly Exploit Roundup

Generated 2026-11-03T08:00:12.576788+00:00 (UTC)

1. Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)
   Source: Rapid7 Cybersecurity Blog | Published: 2026-11-02T11:04:08+00:00 | Score: 27.377
   Overview On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357 , a missing authentication for critical function vulnerability ( CWE-306 ), with a CVSSv3.1 score of 8.8 ; it allows a local authenticated attacker to escalate privileges. CVE-2026-118527 , classified as generation of predictable numbers or identifiers ( CWE-340 ), has an Ivanti-assigned CVSSv3.0 score of 4.3 and, according to CISA's KEV entry , allows a remote authenticated attacker to upload attacker-controlled content to a known location on disk. Per Ivanti, exploitation in the wild has already occurred prior to disclosure, affecting a limited number of customers when these flaws are chained with CVE-2026-104935 , an authentication bypass by spoofing ( CWE-290 ). Rapid7 covered the original disclosure on October 13, 2026 , when a fix for CVE-2026-104935 was available but the privilege es
2. Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors
   Source: The Hacker News | Published: 2026-11-03T05:34:41+00:00 | Score: 21.528
   A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed.

   The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code.

   "SIMATIC IoT2050 Advanced devices running

3. CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV
   Source: The Hacker News | Published: 2026-10-30T07:27:05+00:00 | Score: 19.726
   The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation.

   The vulnerabilities are listed below –

   CVE-2026-97229 (CVSS score: 10.0) – An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise

4. Over 1,000 GitLab servers vulnerable to ongoing RCE attacks
   Source: BleepingComputer | Published: 2026-11-02T12:47:00+00:00 | Score: 19.128
   Over 1,000 Internet-exposed GitLab servers are still unpatched against a maximum-severity flaw actively exploited in remote code execution attacks. […]
5. Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)
   Source: Rapid7 Cybersecurity Blog | Published: 2026-10-30T16:01:53+00:00 | Score: 18.382
   Overview An origin-validation flaw in BeyondTrust Remote Support lets an unauthenticated attacker write files on the appliance and execute code as the site's operating-system user. The entry point is the public customer connection used to start a support session. No account credentials or user interaction are required. The flaw sits between the internal message router, brain , and an appliance-side customer worker, thin-scc . An attacker can put a reserved local router ID into a message's source address. The router forwards the message, and the worker accepts that address as proof that the request came from a local component. This gives the attacker access to an internal file-transfer service, including its native filesystem provider. We first confirmed the file write then used the primitive to upload a PHP file to the site's public directory. Requesting that file gave us code execution as the site user. A Metasploit module now implements the chain with PHP and Unix Command targets. We
6. Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
   Source: The Hacker News | Published: 2026-10-30T07:45:30+00:00 | Score: 17.736
   Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component.

   The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.

   "This module enables you to sell goods and services to customers through an included shopping cart

7. CISA Adds Two Known Exploited Vulnerabilities to Catalog
   Source: Alerts | Published: 2026-10-30T12:00:00+00:00 | Score: 17.262
   CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability CVE-2026-118527 Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitati
8. Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
   Source: SecurityWeek | Published: 2026-11-02T07:57:49+00:00 | Score: 16.285
   CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks. The post Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain appeared first on SecurityWeek .
9. Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
   Source: The Hacker News | Published: 2026-10-29T10:44:46+00:00 | Score: 16.11
   Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild.

   The vulnerability, tracked as CVE-2026-76418, is rated 8.6 on the CVSS scoring system. Successful exploitation could allow an unauthenticated, remote attacker to cause the

10. China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
    Source: The Hacker News | Published: 2026-10-29T06:22:33+00:00 | Score: 15.98
    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized by a China-nexus threat actor known as Warp Panda in attacks targeting the U.S. legal sector.

    The vulnerability in question is CVE-2026-41709 (CVSS score:

End of report.