Vulnerability intelligence

CVE-2026-98432 is a use-after-free vulnerability in the Linux kernel's IPv4 TCP handshake path, affecting kernels dating back to version 4.4. The flaw stems from a race condition involving the ownership and reclamation of IPv4 option data (such as Timestamp or Record Route options) associated with a TCP request socket. When a connection progresses, two processors can act on related request and child sockets while referencing the same IP options object. This allows one path to free the object while another continues to use it, resulting in a stale kernel pointer that can be reached through network traffic. The vulnerability gained significant attention after Anthropic demonstrated that its AI model, Claude, could generate a proof-of-concept exploit for it. The exploit targets Linux servers running a multipath TCP (MPTCP) listener, allowing a remote, unauthenticated attacker to execute arbitrary commands as root. It achieves this in two stages: first, by exploiting the race condition to leak a kernel pointer and bypass Kernel Address Space Layout Randomization (KASLR), and second, by triggering the use-after-free to overflow a buffer and overwrite a callback pointer with a staged payload. The vulnerability has since been patched upstream and backported to all maintained stable kernel branches.

CVE-2026-97229 is an integer overflow vulnerability (CWE-190) located in the CI/CD Regular Expression Compiler of GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw stems from insufficient validation of regular expressions used within project pipeline configurations. Under certain conditions, an unauthenticated remote attacker can exploit this vulnerability by supplying a specially crafted regular expression in a CI/CD configuration file (such as `.gitlab-ci.yml`), which can lead to arbitrary code execution on the affected GitLab server. The vulnerability affects self-managed GitLab versions 19.1 through 19.2.7, 19.3 through 19.3.3, and 19.4 through 19.4.1. Security researchers note that exploitation typically requires the ability to commit a configuration file to a repository. However, this constraint is bypassed on instances where self-registration and project creation are enabled for new users. GitLab has addressed the issue in versions 19.4.2, 19.3.4, and 19.2.8, and there have been no confirmed reports of active exploitation in the wild.

CVE-2026-111357 is a privilege escalation vulnerability affecting Ivanti Connect Secure VPN appliances. The flaw stems from the system mishandling how the privileged `dsinvoked` broker trusts configuration data stored in the `DSCache`. By manipulating this trust—specifically by temporarily modifying library code in memory and altering a maintenance task in the configuration store—an attacker with local authenticated access can execute arbitrary code with root-level privileges. Discovered by cybersecurity firm Volexity, this vulnerability was actively exploited in the wild in October 2026 by a threat actor tracked as UTA0576. The attacker chained CVE-2026-111357 with an authentication bypass (CVE-2026-104935) and a predictable-filename weakness (CVE-2026-118527) to achieve unauthenticated root access on fully patched appliances, which they used to harvest Active Directory credentials and sensitive metadata. In response, Ivanti released security patches on October 29, 2026, and the Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-111357 is a privilege escalation vulnerability affecting Ivanti Connect Secure VPN appliances. The flaw stems from the system mishandling how the privileged `dsinvoked` broker trusts configuration data stored in the `DSCache`. By manipulating this trust—specifically by temporarily modifying library code in memory and altering a maintenance task in the configuration store—an attacker with local authenticated access can execute arbitrary code with root-level privileges. Discovered by cybersecurity firm Volexity, this vulnerability was actively exploited in the wild in October 2026 by a threat actor tracked as UTA0576. The attacker chained CVE-2026-111357 with an authentication bypass (CVE-2026-104935) and a predictable-filename weakness (CVE-2026-118527) to achieve unauthenticated root access on fully patched appliances, which they used to harvest Active Directory credentials and sensitive metadata. In response, Ivanti released security patches on October 29, 2026, and the Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-97229 is an integer overflow vulnerability (CWE-190) located in the CI/CD Regular Expression Compiler of GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw stems from insufficient validation of regular expressions used within project pipeline configurations. Under certain conditions, an unauthenticated remote attacker can exploit this vulnerability by supplying a specially crafted regular expression in a CI/CD configuration file (such as `.gitlab-ci.yml`), which can lead to arbitrary code execution on the affected GitLab server. The vulnerability affects self-managed GitLab versions 19.1 through 19.2.7, 19.3 through 19.3.3, and 19.4 through 19.4.1. Security researchers note that exploitation typically requires the ability to commit a configuration file to a repository. However, this constraint is bypassed on instances where self-registration and project creation are enabled for new users. GitLab has addressed the issue in versions 19.4.2, 19.3.4, and 19.2.8, and there have been no confirmed reports of active exploitation in the wild.

CVE-2026-76418 is a vulnerability affecting the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. The issue stems from logic errors—specifically an unchecked return value leading to a NULL pointer dereference—when secondary authentication is configured on a tunnel group. An unauthenticated, remote attacker can exploit this flaw by sending a crafted request while connecting to the SSL remote access VPN, which triggers an unexpected device reload and results in a denial of service (DoS) condition. A successful VPN login is not required to reach the vulnerable code path. In October 2026, Cisco's Product Security Incident Response Team (PSIRT) identified active exploitation of this vulnerability in the wild, prompting the Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities catalog. While Cisco has released software updates to resolve the issue, there are no official workarounds. Organizations unable to immediately apply the patches can temporarily mitigate the risk by disabling secondary authentication on the default or user-configured tunnel groups.