The turn of October and November gave administrators no breathing room. Security bulletins highlight a clear trend: threat actors are targeting edge network appliances, controllers, or core developer infrastructure. If your network runs Cisco Catalyst SD-WAN controllers, ASA firewalls with SSL VPN tunnels, or GitLab instances, this week requires immediate attention.
Most concerning is the critical flaw in Cisco Catalyst SD-WAN—a CVSS 10.0 score is fully justified when an authentication bypass in peering mechanisms allows a remote intruder to take over core networks via NETCONF. Furthermore, the fresh WordPress Core 7.1.4 release patches a race condition RCE vulnerability actively exploited in the wild (nearly 63,000 scan attempts logged in the first 24 hours). Key technical facts and remediation steps are detailed below.
1. Cisco Catalyst SD-WAN: Remote Authentication Bypass (CVE-2026-20127)
An authentication bypass vulnerability in peering mechanisms within Cisco Catalyst SD-WAN components allows unauthenticated attackers to bypass security controls and gain administrative privileges.
The defect lies in core node communication verification logic. By sending a crafted network request, an attacker can authenticate to controllers as a high-privileged internal user, granting direct access to the NETCONF interface and full control over organizational network configuration, routing, and traffic segmentation.
- Identifier: CVE-2026-20127
- Base Score: CVSS 10.0 (Critical)
- Exploitation Status: Cisco advisory published October 28, 2026; extreme compromise risk
- Affected Systems: Cisco Catalyst SD-WAN Controller (vSmart), SD-WAN Manager (vManage), SD-WAN Validator (vBond)
- Mitigation: Upgrade software to vendor-recommended versions (no workarounds available)
- Source: Cisco Security Advisory
2. Cisco Secure Firewall ASA & FTD: SSL VPN Denial of Service (CVE-2026-76418)
CISA added a vulnerability in Remote Access SSL VPN services on Cisco ASA and FTD firewalls to its Known Exploited Vulnerabilities (KEV) catalog on October 29.
The flaw occurs when secondary authentication is enabled on a tunnel group. An unauthenticated attacker can send crafted requests during VPN session establishment, triggering return value check failures and NULL pointer dereferences. This results in an immediate device crash and reboot loop, cutting off remote access for all users.
- Identifier: CVE-2026-76418
- Base Score: CVSS 8.6 (High)
- Exploitation Status: Actively exploited in the wild (CISA KEV)
- Affected Systems: Cisco Secure Firewall ASA and FTD with active SSL VPN and secondary auth
- Mitigation: Apply official Cisco patches
- Source: Cisco Security Advisory
3. WordPress Core 7.1.4: Update Race Condition RCE
The WordPress security team released version 7.1.4, addressing an update installation race condition and multiple Stored XSS flaws.
The critical defect involves the brief window during archive download and extraction where an unauthenticated attacker sending concurrent requests can achieve arbitrary PHP code execution. Threat telemetry recorded nearly 63,000 scanning and exploitation attempts within 24 hours. Additional fixes patch Stored XSS in the Interactivity API and editor blocks.
- Release: WordPress Core 7.1.4
- Base Score: CVSS 8.1 (High)
- Exploitation Status: Massive automated scanning and attacks observed
- Affected Systems: WordPress Core versions 4.7 through 7.1.3
- Mitigation: Upgrade immediately to WordPress 7.1.4
- Source: WordPress News
4. VMware ESX: Insufficient Administrative Auditing in CISA KEV (CVE-2026-41709)
A vulnerability in VMware ESX/ESXi hypervisors was added to CISA KEV, heavily leveraged in advanced virtualization targeting campaigns.
The flaw allows administrators (or credentials compromise actors) to perform specific VM and host configuration operations bypassing event logging mechanisms. Ransomware groups use this to cover tracks, modify virtual disks, and shut down machines without vCenter audit trails.
- Identifier: CVE-2026-41709
- Base Score: CVSS 2.7 (Tactically severe)
- Exploitation Status: Exploited in the wild (CISA KEV)
- Affected Systems: VMware ESXi supported versions
- Mitigation: Install Broadcom Security Advisory 38017 patches
- Source: Broadcom Security Advisory
5. GitLab CE/EE: Regular Expression Compiler RCE (CVE-2026-97229)
A severe GitLab vulnerability resulted in a real-world security incident when Alpine Linux was forced to rebuild its GitLab server and reset credentials following an RCE attempt.
The cause is an integer overflow in the Ruby Onigmo regular expression compiler utilized by CI/CD pipeline parsers. Unauthenticated inputs trigger memory corruption and arbitrary code execution under the GitLab process user.
- Identifier: CVE-2026-97229
- Base Score: CVSS 10.0 (Critical)
- Exploitation Status: Actively exploited in the wild, Alpine Linux incident
- Affected Systems: GitLab CE/EE 19.2.0 through 19.4.1
- Mitigation: Upgrade to GitLab 19.4.2, 19.3.5, or 19.2.8
- Source: GitLab Patch Release
6. Linux Kernel: Remote Root via MPTCP (CVE-2026-98432)
Anthropic researchers published a stable network exploit demonstrating remote root code execution on modern Linux systems.
The flaw resides in IPv4 socket option handling (tcp_v4_syn_recv_sock), causing improper resource deallocation without RCU grace periods. With MPTCP listeners enabled, attackers manipulate kernel memory over the network, defeat KASLR, and spawn root shells.
- Identifier: CVE-2026-98432
- Base Score: CVSS 9.8 (Critical)
- Exploitation Status: Functional network PoC exploit
- Affected Systems: Linux kernel with active MPTCP socket support
- Mitigation: Update system kernel
- Source: Sekurak Analysis
Action Items for Today
- Upgrade WordPress to 7.1.4: Block automated scanning for update race condition RCE.
- Patch Cisco SD-WAN Controllers: Apply top-priority CVSS 10.0 updates immediately.
- Secure Cisco ASA/FTD Firewalls: Prevent SSL VPN DoS crashes.
- Upgrade GitLab: Install versions 19.4.2 / 19.3.5 / 19.2.8.
- Check MPTCP and Update Linux Kernel: Defend against network kernel exploitation.
