Zero-days defined the October 2026 vulnerabilities that mattered most. Of the nine below, six were exploited before a fix was available, and two more were attacked within days of their patches. Microsoft shipped its largest Patch Tuesday to date on 13 October, fixing 1,413 CVEs, and one of them, a Windows Shell flaw, was already being used in attacks.
The other products on the list sit in two places attackers keep coming back to. The first is the network edge: Ivanti Connect Secure, Palo Alto Networks PAN-OS and Cisco’s ASA and Firepower Threat Defense firewalls. The second is any system that processes content sent in from outside: two email gateways (Fortinet FortiMail and Cisco Secure Email Gateway), the PHP runtime behind millions of websites, and the GitLab and Atlassian servers that development and IT teams expose to the internet.
Several of these are repeat visits. It is the second exploited Cisco Secure Email Gateway flaw in two months, the second Cisco firewall VPN denial-of-service zero-day since August, and the third Windows Shell zero-day of 2026. The nine entries below give the affected versions and the actions needed to close each one.
Table of Contents
Windows Shell Mark of the Web Bypass Zero-Day – CVE-2026-96951
Overview: Windows tags files downloaded from the internet with Mark of the Web (MotW). That tag is what triggers SmartScreen checks and opens Office documents in Protected View. CVE-2026-96951 lets an attacker craft a file that Windows Shell opens without honouring the tag, so the warnings that would normally stop a user from running a downloaded file do not appear. Microsoft’s own example is a file sent to the target by email or instant message.
Severity and score: High, CVSS 8.8. Microsoft rates it Important.
Type: Security feature bypass caused by command injection, CWE-77.
Disclosure: Microsoft fixed the flaw on 13 October 2026 in a release that covered 1,413 CVEs: 1,102 in Windows, 134 in Office, 61 in developer tools and 36 in SharePoint Server. Microsoft linked the rising monthly totals to its growing use of AI to find vulnerabilities. Affected versions include Windows 10 1607, 1809, 21H2 and 22H2, Windows 11 23H2 to 26H2, and Windows Server 2012 R2 to 2025, including Server Core.
Exploitation: Microsoft confirmed exploitation before the patch but has not described the attacks or the groups behind them. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 13 October with a deadline of 16 October. A MotW bypass is rarely the whole attack. It is used to get a malicious file past the user’s last warning, after which the payload does the real damage.
Mitigation: Install the October 2026 cumulative updates on all supported Windows desktops and servers. Block or quarantine archive and shortcut attachments at the email gateway where the business does not need them, and keep Office macros blocked for files from the internet. Users are the target of this flaw, so the reporting habits covered in our article on security awareness training for the age of AI matter here as much as the patch.
Ivanti Connect Secure Zero-Day Chain to Root – CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527
Overview: Attackers chained three flaws in Ivanti Connect Secure VPN appliances to run code as root without logging in. CVE-2026-104935 is the entry point: a single HTTP request with a crafted X-DSCGI-PATH header bypasses authentication and reaches functions meant for logged-in users, leading to code execution. CVE-2026-111357 escalates privileges on the appliance, and CVE-2026-118527, a predictable-identifier flaw, allows file uploads.
Severity and score: CVE-2026-104935 is reported at CVSS 8.6. The chain as a whole gives an unauthenticated attacker root on a VPN gateway.
Type: Authentication bypass leading to remote code execution (CVE-2026-104935), privilege escalation (CVE-2026-111357), and use of predictable identifiers enabling file upload (CVE-2026-118527).
Disclosure: Ivanti patched CVE-2026-104935 on 13 October 2026 in Connect Secure 22.8R2.5 and 25.1.1.2, the same day Volexity published its analysis of the attacks. The fixes for the other two flaws followed on 29 October in 22.8R2.6 and 25.1.1.3, so appliances updated in mid-October need upgrading again.
Exploitation: Volexity found a threat actor it tracks as UTA0576 using the chain against a fully patched appliance (version 22.8R2.4 at the time) in the first week of October. Defused reported exploitation from 1 October, and Volexity saw the chain in use from 3 October. The attacker re-ran the exploit for each command and tampered with logs, which kept the activity out of Ivanti’s Integrity Checker Tool. CISA added CVE-2026-104935 to the KEV catalog on 13 October and the other two on 30 October, with deadlines of 2 November and 13 November.
Mitigation: Upgrade to 22.8R2.6 or 25.1.1.3, which close the full chain. Because the attacker evaded the Integrity Checker Tool, a clean ICT result is not proof that an appliance is safe. Review VPN session logs and authentication records from 1 October onwards, rotate credentials and certificates stored on any appliance that ran a vulnerable build, and follow Ivanti’s guidance on factory reset where compromise is suspected.
PHP2Shell Unauthenticated Remote Code Execution – CVE-2026-109618 and CVE-2026-109619
Overview: Two flaws in the PHP interpreter allow an unauthenticated web request to run code as the web server’s worker account. CVE-2026-109618 corrupts memory when PHP runs out of memory during request cleanup, and public analysis ties it to the session upload progress feature. CVE-2026-109619 leaves PHP globals pointing at request memory that has already been freed. Both trigger before application code runs, so web application firewalls and application-level protections may not see them. Our PHP2Shell article covers the detail.
Severity and score: Critical, CVSS 4.0 score 9.2 for both (PHP security team).
Type: Memory corruption (CVE-2026-109618) and use-after-free, CWE-416 (CVE-2026-109619).
Disclosure: PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026. Installations using Apache with mod_php are the most exposed configuration. A separate Brotli decoder flaw, CVE-2026-111497, was fixed in Windows builds on 26 October, and a further configuration-dependent issue, CVE-2026-115560, remains unpatched.
Exploitation: Amazon Threat Intelligence saw exploitation attempts from 17 October, four days before the fixes. watchTowr’s honeypot network recorded exploitation from 21 October, and a researcher confirmed code execution against an Apache mod_php server running PHP 8.4.26. Several public exploit repositories appeared within days. CISA added both CVEs to the KEV catalog on 26 October with a deadline of 29 October.
Mitigation: Upgrade to the fixed PHP releases, or to your Linux distribution’s patched packages, and restart PHP-FPM or the web server so the new binary is running. Hosting control panels and appliances often bundle their own PHP build, so check those separately. Where patching is delayed, disable session.upload_progress and block multipart/form-data requests for applications that do not accept uploads. Sophos recommends reviewing exposed servers for signs of compromise from 1 August, when PHP first received reports.
GitLab CI/CD Regular Expression Remote Code Execution – CVE-2026-97229
Overview: An integer overflow in the regular expression compiler used by GitLab CI/CD lets an attacker run operating system commands as the git user. The attack uses a crafted regular expression in a .gitlab-ci.yml file together with a specially formed UTF-8 repository path. Planting the file normally needs some access, but on instances that allow self-registration and public project creation, anyone on the internet can do it.
Severity and score: Critical, CVSS 10.0.
Type: Integer overflow or wraparound, CWE-190.
Disclosure: GitLab released 19.2.8, 19.3.5 and 19.4.2 on 12 October 2026, and the CVE was published on 13 October. Affected versions are 19.2.0 to 19.2.7, 19.3.0 to 19.3.4 and 19.4.0 to 19.4.1. GitLab.com is already patched.
Exploitation: Alpine Linux disclosed an attempt against its GitLab instance on 20 and 21 October, eight days after the patch. The attacker crashed GitLab worker processes eight times with crafted CI configurations and downloaded Alpine’s GitLab container image. Further attempts on 25 and 26 October were blocked. CISA added the flaw to the KEV catalog on 29 October with a deadline of 1 November. Shadowserver counted about 1,000 internet-facing servers still unpatched.
Mitigation: Upgrade self-managed GitLab to the 21 October releases (19.2.9, 19.3.6, 19.4.3 or 19.5.1), which also fix a second regular expression compiler flaw, CVE-2026-110264. Disable open self-registration unless you need it. Review CI job logs for crashed workers and unfamiliar pipelines since 12 October, and rotate CI/CD variables, deploy keys and runner tokens on any instance that ran a vulnerable build while exposed to the internet.
Atlassian Data Center Pre-Authentication File Read – CVE-2026-21589
Overview: A path traversal flaw in self-hosted Atlassian Data Center products lets an unauthenticated attacker read files in the web application root. The attacker needs the exact file name and cannot list directories, but configuration files in that location can contain credentials in plain text. Affected products include Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye.
Severity and score: Critical, CVSS 4.0 score 9.3.
Type: Path traversal resulting in files or directories accessible to external parties, CWE-22 and CWE-552.
Disclosure: Atlassian published its advisory on 5 October 2026 and urged immediate upgrades. Atlassian Cloud is not affected. Fixed versions include Jira Software 9.12.40, 10.3.26 and 11.3.12; Jira Service Management 5.12.40, 10.3.26 and 11.3.12; Confluence 9.2.26 and 10.2.19; Bitbucket 9.4.26, 10.2.8 and 10.5.1; Bamboo 10.2.24 and 12.1.12; and Crowd 6.3.7, 7.0.3, 7.1.7 and 7.2.4.
Exploitation: VulnCheck flagged exploitation on 7 October, two days after the advisory, in activity against Bamboo Data Center. Shadowserver reported it on 14 October. CISA added the flaw to the KEV catalog on 15 October with a deadline of 18 October and marked it for forensic triage, so US federal agencies must check for past compromise as well as patch.
Mitigation: Upgrade every Data Center instance to a fixed release and take instances off the internet where users can reach them through a VPN instead. Treat any secret stored in a readable file as exposed: rotate database passwords, application links, API tokens and mail credentials in the application configuration. Atlassian has said it cannot confirm whether customer instances were compromised, so review web access logs for unusual file requests from early October.
Fortinet FortiMail Unauthenticated File Write – CVE-2026-104286
Overview: A path traversal flaw in FortiMail lets an unauthenticated attacker write files to the appliance, which can lead to code execution. FortiMail sits in the mail flow, so the system that filters incoming email becomes the way in.
Severity and score: Critical, CVSS 9.8.
Type: Path traversal, CWE-22, with improper handling of a NULL byte.
Disclosure: Fortinet published advisory FG-IR-26-175 on 1 October 2026 and updated it on 5 October. Affected versions are 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8 and 7.2.0 to 7.2.9. Fixes were not available for most branches at disclosure. Fortinet has since listed 8.0.2, 7.6.7 and 7.4.9 as the fixed releases, and updated FortiMail Cloud itself on 5 October. No fixed build has been listed for 7.2.
Exploitation: Fortinet stated at disclosure that the flaw had been exploited in the wild. It has not said when exploitation started or how many customers were affected. CISA added it to the KEV catalog on 1 October with a deadline of 4 October.
Mitigation: Upgrade to 8.0.2, 7.6.7 or 7.4.9. Appliances on 7.2 need to move to 7.4 or later. Until then, disable Identity Based Encryption (IBE) if it is not in use and make sure the management interface is not reachable from the internet. Review the appliance for unexpected files and administrator accounts. Fortinet also released an out-of-band hardening update for FortiOS, FortiManager and FortiAnalyzer on 22 October, covered in our Fortinet October 2026 upgrade guide.
Palo Alto Networks PAN-OS Management Interface Code Injection – CVE-2026-0322
Overview: A code injection flaw in the PAN-OS management interface lets an attacker with administrator credentials run code as root on the firewall. PA-Series and VM-Series firewalls and Panorama are affected. Cloud NGFW and Prisma Access are not.
Severity and score: High, CVSS 4.0 score 8.6.
Type: Code injection, CWE-94.
Disclosure: Palo Alto Networks disclosed the flaw on 14 October 2026 and updated the version table on 15 October. Fixed builds include 10.2.18-h12, 11.1.16-h3, 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2 and 12.2.4. Check the advisory for the build that applies to your release.
Exploitation: Palo Alto Networks reported very limited exploitation aimed at management interfaces and published three IP addresses linked to the activity. CISA added the flaw to the KEV catalog on 14 October with a deadline of 17 October.
Mitigation: The vendor offers no workaround, so upgrading is the fix. The flaw needs admin access, and attackers who exploit it either have stolen credentials or reach an exposed interface where weak credentials work. Restrict management access to a small set of internal addresses, check the published IP addresses against your logs, and review administrator logins and configuration changes since early October.
Cisco Secure Email Gateway Malware Protection Path Traversal – CVE-2026-76519
Overview: A relative path traversal flaw in the Advanced Malware Protection (AMP) file reputation feature of Cisco Secure Email Gateway lets an unauthenticated attacker write arbitrary files and run commands as root. The attack needs nothing more than an email with a crafted attachment sent through an affected gateway. It is the second exploited flaw in the product in two months, after CVE-2026-76461 in our September 2026 roundup.
Severity and score: Critical, CVSS 9.8.
Type: Relative path traversal, CWE-23.
Disclosure: Cisco published advisory cisco-sa-esa-afw-zqYJkjxp on 14 October 2026. Physical and virtual appliances are affected where File Reputation is enabled and assigned to a mail policy and Content Scanner Tools is earlier than 25.3.0.5525. Secure Email and Web Manager and Secure Web Appliance are not affected, and Cisco handles Secure Email Cloud Gateway updates itself. SecurityWeek reports that the underlying fix shipped in the September releases, 15.5.5-014 and 16.5.0-780, before the flaw was disclosed.
Exploitation: Cisco’s PSIRT became aware of exploitation in October. CISA added the flaw to the KEV catalog with a deadline of 17 October.
Mitigation: There is no workaround. Confirm that Content Scanner Tools on every on-premises gateway is at 25.3.0.5525 or later and that the appliance runs a fixed AsyncOS release. Gateways that were patched for CVE-2026-76461 in September may already be covered, but check the Content Scanner Tools version rather than assuming. Review appliances for unexpected files and accounts, and consider whether a cloud-managed email security service would take this patch cycle off your team.
Cisco Secure Firewall ASA and FTD SSL VPN Denial of Service – CVE-2026-76418
Overview: A flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and Firepower Threat Defense (FTD) software lets an unauthenticated attacker force the device to reload. The condition persists while the attack continues. The flaw is triggered when secondary authentication is configured on a tunnel group. Cisco’s advisory does not describe data theft or device takeover, but a firewall that keeps rebooting takes remote access down for the whole organisation.
Severity and score: High, CVSS 8.6.
Type: Unchecked return value leading to a NULL pointer dereference, CWE-690.
Disclosure: Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 on 28 October 2026. Fixed ASA releases include 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1. FTD fixes are listed in the same advisory.
Exploitation: Cisco became aware of exploitation in October and has not named the attackers. CISA added the flaw to the KEV catalog on 29 October. It is the second ASA and FTD VPN denial-of-service zero-day since August, after CVE-2026-20349 in our August 2026 roundup.
Mitigation: There is no workaround. Upgrade to a fixed release, starting with devices that terminate remote access VPN and have secondary authentication configured. Watch for unexpected reloads and crash files on ASA and FTD devices. Repeated reloads during October are a sign the device was targeted.
What the October 2026 Vulnerabilities Showed
Six of the nine flaws were exploited before a fix existed: the Windows Shell bypass, the Ivanti chain, PHP2Shell, FortiMail, PAN-OS and the Cisco ASA and FTD flaw. FortiMail customers on most branches had no patch at all on the day of disclosure. For these, the first line of defence was not patching. It was whether the management interface was exposed, whether IBE or File Reputation was switched on, and whether anyone was watching the appliance logs.
The two flaws that did have a head start did not keep it for long. Atlassian’s file read was exploited two days after its advisory, and GitLab’s CI/CD flaw eight days after its patch. Ivanti showed something worse. An attacker who tampers with logs and avoids the vendor’s own integrity checker can stay on a fully patched appliance, so patching alone does not answer whether a device was compromised before the fix.
Volume did not let up either. Microsoft fixed 1,413 CVEs in one release, and Oracle’s Critical Patch Update on 20 October fixed 1,209 unique CVEs, including six rated CVSS 10.0. Oracle reported none as exploited, but Defused’s decoys recorded probing of an E-Business Suite SQL injection, CVE-2026-101767, from 27 October, a week after the fix. Fortinet will publish full details of its 22 October hardening release on 10 November. Patch teams cannot treat every one of these the same way. Ranking work by KEV listing, internet exposure and what each system controls (a VPN, a mail gateway, a code repository) is what keeps the critical fixes from waiting behind the routine ones.
Where iConnect Fits In
iConnect’s vulnerability assessment and penetration testing services find the internet-facing systems that run affected versions, including VPN gateways, email gateways, firewall management interfaces and self-hosted GitLab and Atlassian servers. Our SOC services monitor for the indicators in this roundup around the clock from Dubai, and our managed security services team can help prioritise patching and check devices that ran vulnerable builds for signs of compromise. Contact us to review your exposure to the October vulnerabilities.
