October 2026 Vulnerabilities: Ivanti, Windows, GitLab Flaws

The vulnerabilities that matter most this month are an actively exploited Ivanti Connect Secure zero-day chain, a Windows Shell bypass fixed in a record-setting Patch Tuesday, and max-severity bugs in tools developers run, including GitLab. Microsoft's October update alone fixed roughly 1,400 flaws, so the real work is triage. This roundup covers what each flaw does, what is confirmed, and what to patch first.

Key Takeaways

• Microsoft's October 13 Patch Tuesday set a record at about 1,411 fixes by BleepingComputer's count. Only one flaw, CVE-2026-96951 in Windows Shell, was confirmed as exploited.
• Ivanti Connect Secure CVE-2026-104935 has been exploited since at least October 3 inside a chain that gives unauthenticated root access. The privilege-escalation link in that chain was still unpatched when Volexity published.
• Citrix NetScaler CVE-2026-88779 is officially a denial-of-service bug, but researchers are testing whether it also allows code execution.
• GitLab CVE-2026-110264 can let an unauthenticated attacker run code on an unpatched self-managed server.
• Patch internet-facing edge devices and self-hosted GitLab first, then Windows endpoints.

What did Microsoft's October 2026 Patch Tuesday fix?

Microsoft shipped fixes for a record number of flaws on October 13. BleepingComputer counted 1,411 released that day, with 70 rated Critical and 57 of those remote code execution bugs. Other outlets report slightly different totals because they count flaws differently, so treat the exact figure as approximate. BleepingComputer ties the volume to Microsoft's growing use of AI platforms to find vulnerabilities.

The one confirmed zero-day under active attack is CVE-2026-96951, a security feature bypass in Windows Shell. Microsoft's advisory describes it as command injection, and BleepingComputer reports it lets attackers bypass Mark of the Web, the marker Windows attaches to downloaded files. Microsoft has not said how attackers used it or who reported it.

Two more were publicly disclosed before the patch, though not exploited. CVE-2026-108398 is an untrusted search path flaw in .NET Framework that could bypass Windows Defender Application Control and run unauthorized code in a protected process. It was found by James Forshaw of Google Project Zero. CVE-2026-92707 is a denial-of-service flaw in MessagePack-CSharp, which matters if your .NET services deserialize untrusted MessagePack data. Check Microsoft's advisory for the fixed version.

Among the Critical fixes, PCWorld highlights Exchange Server RCE CVE-2026-70571 and SharePoint elevation-of-privilege flaw CVE-2026-102866, which it describes as the only SharePoint bug an attacker could exploit without logging in. Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016 also reached end of updates, so October's update is their last. The next Patch Tuesday is scheduled for November 10.

How does the Ivanti Connect Secure zero-day chain work?

An attacker chains three bugs to get unauthenticated root code execution on an Ivanti Connect Secure VPN appliance, with no password and no user interaction. Volexity found the chain in use against a fully patched 22.8R2.4 appliance during the first week of October and attributes it to a previously unknown actor it tracks as UTA0576. Ivanti tracks the authentication bypass and RCE parts as CVE-2026-104935 and released patches for them on October 13.

The first bug is an authentication bypass. The attacker requests the public login script welcome.cgi, but names a different, protected script in an X-DSCGI-PATH header. The appliance checks the URL to decide whether the request is allowed, and uses the header to decide where it goes. The second bug is in the wu.cgi upload handler. It writes an uploaded file to disk before validating it, so a Perl script disguised as a ZIP exists briefly, and parallel requests can execute it before it is deleted. The third bug is a privilege escalation in how the dsinvoked service trusts configuration data, which turns code execution into root.

Volexity saw the actor harvest credentials, query Active Directory for LAPS passwords and BitLocker recovery keys, sniff LDAP traffic and password-spray accounts. It deployed no web shell or malware and re-ran the exploit for each command. It also trimmed log entries, and because the privilege escalation patches code in memory only, Ivanti's Integrity Checker Tool does not detect it. Volexity rates its confidence as low that the motive is criminal rather than espionage, and medium that the actor used LLMs to build and run the chain.

According to BleepingComputer, affected versions are 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Shadowserver tracks more than 5,500 exposed instances, though it cannot say how many are honeypots or already protected. Volexity says Ivanti was still working on a fix for the privilege escalation bug. Its detection advice is to watch for requests to welcome.cgi where the X-DSCGI-PATH header does not match the URL, for example:

X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi

If you suspect compromise, do memory and network forensics rather than trusting the Integrity Checker, and check /tmp for leftover post-exploitation files.

Is the Citrix NetScaler SAML flaw really just a denial-of-service bug?

Citrix classifies CVE-2026-88779 as a denial-of-service flaw, but the evidence so far suggests it may do more. It is a memory buffer flaw in NetScaler ADC and Gateway appliances using SAML authentication, rated CVSS 8.7. Citrix says it has seen targeted attacks causing denial of service and found no impact on data integrity.

Administrators reported freshly patched appliances rebooting repeatedly. One admin saw crafted SAML usernames containing shell commands that fetch and run a payload, though their logs showed attempts and correlated crashes rather than confirmed execution. Researcher Kevin Beaumont reported a patched honeypot running a downloaded binary, and watchTowr Labs said it reproduced the flaw. Beaumont also pointed out that an earlier NetScaler flaw, CVE-2025-6543, was first described as denial of service before attacks showed it could give remote code execution. Citrix has not confirmed code execution for this one.

Citrix released NetScaler ADC and Gateway builds 14.1-73.41 and 13.1-64.28. FIPS deployments should use 14.1-73.41 FIPS, and NetScaler ADC FIPS and NDcPP customers on 13.1 should install 13.1-37.282. If you recently upgraded for an earlier set of NetScaler zero-days, you need to upgrade again. CISA added the flaw to its Known Exploited Vulnerabilities catalog. You are exposed if your appliance is configured as a SAML service provider or identity provider, which these entries in the config indicate:

add authentication samlAction
add authentication samlIdPProfile

What is the GitLab CVE-2026-110264 vulnerability?

CVE-2026-110264 is a maximum-severity integer overflow in GitLab's Regular Expression Compiler that can let an unauthenticated attacker run code on the GitLab server under certain conditions. A researcher using the handle joaxcar reported it through HackerOne. GitLab fixed it in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 for both Community and Enterprise editions. GitLab.com is already patched, and GitLab Dedicated tenants on 19.3.5-internal0 or 19.4.2-internal0 and later need no action.

BleepingComputer's report does not say the flaw is being exploited. It does say Shadowserver sees more than 2,700 exposed GitLab Community Edition instances. This is the second regex-compiler bug in about ten days: CVE-2026-97229, a 10/10 flaw in the CI/CD Regular Expression Compiler, was reported by the same researcher. In September, CISA added another max-severity GitLab bug, CVE-2026-85706, to its exploited list one day after the patch.

What else was patched or exploited this month?

BleepingComputer's October roundup lists several other developer-relevant items. These are one-line summaries from that roundup, so check each vendor advisory before acting:

• Atlassian patched critical CVE-2026-21589 in self-hosted Data Center products including Confluence, Jira and Bitbucket. Attackers exploited it soon after a proof of concept appeared.
• Cisco fixed critical NX-OS flaws that can give attackers root-level code execution on Nexus switches.
• Docker patched a Docker Hub flaw that let attackers impersonate users and push images to other people's repositories.
• SonicWall's critical SMA1000 SSRF flaw was exploited within two days of disclosure.
• SAP's October updates included a maximum-severity OAuth2 SSRF flaw in Cloud SDK for Python.

Two earlier Webman breakdowns still apply if you run these products: the FortiMail zero-day CVE-2026-104286 and the PHP2Shell fixes in PHP 8.5.12.

What should I patch first?

1. Ivanti Connect Secure: upgrade to the patched release, and if the appliance was internet-exposed since early October, investigate it as possibly compromised.
2. Citrix NetScaler with SAML configured: move to the fixed builds above, even if you patched recently.
3. Self-managed GitLab: upgrade to one of the fixed versions.
4. Other exploited edge products you run, such as FortiMail, SonicWall SMA1000 and Atlassian Data Center.
5. Windows endpoints: CVE-2026-96951 first, then Exchange, SharePoint and the other Critical fixes.
6. Developer dependencies: update MessagePack-CSharp if you handle untrusted input with it.

Wrapping Up

Most of this month's exploited bugs sit on internet-facing infrastructure, not on laptops. Start by listing every Ivanti, NetScaler and self-hosted GitLab instance you run, and patch those before working through the Windows backlog.

Sources

• Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days (BleepingComputer)
• October Patch Tuesday coverage (PCWorld)
• Chained Exploitation of Ivanti Connect Secure Zero-Days (Volexity)
• Ivanti warns of Connect Secure zero-day exploited in attacks (BleepingComputer)
• Ivanti security advisory for CVE-2026-104935
• Citrix patches NetScaler SAML zero-day exploited in attacks (BleepingComputer)
• GitLab warns of new max severity code execution vulnerability (BleepingComputer)
• GitLab 19.5.1 patch release notes