Isophoric News · Tuesday, November 3, 2026
Patch now: CISA adds Ivanti, GitLab and Cisco flaws to its exploited list; Synology warns of ransomware and VulnCheck reports attempts on a Siemens flaw
The Cybersecurity and Infrastructure Security Agency added four actively exploited flaws to its Known Exploited Vulnerabilities catalog on Oct. 29 and 30, two in Ivanti Connect Secure, one in GitLab and one in Cisco's firewall software, with fix deadlines for federal civilian agencies, according to the catalog. Synology separately urged owners of its network storage devices to update their DiskStation Manager software after ransomware attacks on outdated versions, and the security firm VulnCheck said attackers had tried to exploit a maximum-severity flaw in Siemens SIMATIC IoT2050 Advanced devices. Siemens' own advisory does not mention exploitation, and neither the Synology nor the Siemens flaw is on CISA's list. As CISA lists them: CVE-2026-111357, Ivanti Connect Secure, missing authentication that could let a local authenticated attacker escalate privileges, due Nov. 2; CVE-2026-118527, Ivanti Connect Secure, predictable identifiers that let a remote authenticated attacker upload files, due Nov. 13; CVE-2026-97229, GitLab Community Edition and Enterprise Edition, an integer overflow that could let an unauthenticated user run code through a crafted regular expression in a CI/CD configuration, due Nov. 1; and CVE-2026-76418, Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, a flaw that could let an unauthenticated remote attacker force the device to reload, due Nov. 1. Three of the four deadlines had passed by Tuesday. Synology said on Oct. 29 that attackers were exploiting a flaw patched in December 2024 without naming it, and BleepingComputer reported that the company pointed to a 2024 advisory covering CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445; owners reported files locked by the C3RB3R ransomware, BleepingComputer and The Hacker News reported. Siemens fixed the IoT2050 flaw, CVE-2026-58115, in version 4.3.4.1, according to its August advisory, and VulnCheck said its decoy sensors logged 16 exploit attempts from one address between Oct. 30 and Nov. 1, which it read as opportunistic mass scanning. Neither the Synology nor the Siemens flaw was in CISA's catalog as of its Oct. 30 release.
Source A · Source B · Source C · Source D · Source E · Source F · Source G