Security Advisory: Weekly Advisory October 14th, 2026

In this week’s Security Advisory

• **Updated** SonicWall Warns of Maximum-Severity SSRF Vulnerability in SMA1000 Gateways
• Citrix Patches Critical NetScaler Remote Code Execution Vulnerability
• Critical GitLab Remote Code Execution Vulnerability
• Ivanti Connect Secure Vulnerability Actively Exploited
• Fortinet Patches Multiple Vulnerabilities
• Cisco Patches Critical Nexus Switch Vulnerabilities
• Microsoft Patches 1,413 Vulnerabilities in October Patch Cycle

**Updated** SonicWall Warns of Maximum-Severity SSRF Vulnerability in SMA1000 Gateways

SonicWall has confirmed that this vulnerability has now been exploited in the wild. If you have not applied patches, it is recommended that you do so urgently.

More Reading / Information

• https://www.bleepingcomputer.com/news/security/max-severity-sonicwall-sma1000-flaw-now-exploited-in-attacks/https://www.helpnetsecurity.com/2026/03/24/netscaler-adc-gateway-cve-2026-3055/

Original Advisory:
SonicWall has released a patch for CVE-2026-102255 (CVSS 10/10), a server-side request forgery (SSRF) vulnerability affecting SMA1000 remote access appliances. The issue stems from an alternate access path in the Appliance WorkPlace interface. Exploitation of this vulnerability could allow an unauthenticated attacker to force the appliance to make internal requests and perform unauthorized operations.

Affected Versions

• SMA1000 6210, 7210, and 8200v appliances running 12.4.3-03526, 12.5.0-02952, and older versions.

Recommendations

Apply the latest patches.

More Reading / Information

• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017
• https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-max-severity-ssrf-flaw-in-sma1000-gateways/

Citrix Patches Critical NetScaler Remote Code Execution Vulnerability

Citrix has released a patch for CVE-2026-107406 (CVSS 9.5/10), a critical memory overflow vulnerability affecting NetScaler ADC and NetScaler Gateway appliances configured as a SAML Identity Provider or Service Provider. Successful exploitation could lead to remote code execution or cause the appliance to crash, resulting in denial-of-service. Citrix has not observed exploitation of this vulnerability in the wild but is urging customers to patch immediately.

Affected Versions

• NetScaler ADC and Gateway prior to 14.1-73.46.
• NetScaler ADC and Gateway prior to 13.1-64.29.
• NetScaler ADC 14.1-FIPS prior to 14.1-73.46 FIPS.
• NetScaler ADC 13.1-FIPS/NDcPP prior to 13.1-37.283.

Recommendations

Upgrade NetScaler ADC and Gateway appliances to the applicable patched version immediately.

More Reading / Information

• https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697191
• https://www.bleepingcomputer.com/news/security/citrix-warns-admins-to-patch-new-netscaler-rce-flaw-immediately/

Critical GitLab Remote Code Execution Vulnerability

GitLab has released a patch for a critical vulnerability, CVE-2026-97229 (CVSS 10/10), affecting the CI/CD Regular Expression Compiler. The flaw is caused by an integer overflow and insufficient validation of regular expressions, allowing an unauthenticated remote attacker to execute arbitrary code on the GitLab server using a specially crafted regular expression in a CI/CD configuration. GitLab.com has already been patched, while administrators of self-managed GitLab instances are being urged to update immediately.

Affected Versions

• GitLab CE/EE 19.2 prior to 19.2.8.
• GitLab CE/EE 19.3 prior to 19.3.5.
• GitLab CE/EE 19.4 prior to 19.4.2.

Recommendations

Upgrade self-managed GitLab instances to versions 19.2.8, 19.3.5, 19.4.2, or later.

More Reading / Information

• https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/#cve-2026-97229—integer-overflow-issue-in-cicd-regular-expression-compiler-impacts-gitlab-ceee
• https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/

Ivanti Connect Secure Vulnerability Actively Exploited

Ivanti has released a patch for an exploited vulnerability affecting its Connect Secure enterprise SSL VPN product. The vulnerability, CVE-2026-104935 (CVSS 8.6/10), is an authentication bypass that allows a remote attacker to execute arbitrary commands. It has been confirmed that exploitation of this vulnerability has been seen in the wild this month. Attackers have been chaining it with additional vulnerabilities to achieve root-level code execution, steal credentials, and exfiltrate sensitive information. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog and is urging organizations to patch immediately.

Affected Versions

• Ivanti Connect Secure 22.8R2.4 and earlier.
• Ivanti Connect Secure 25.1.2.2 and earlier.
• Ivanti Connect Secure 25.1.1.1 and earlier.

Recommendations

Upgrade to versions 22.8R2.5, 25.1.3.0/25.1.3.1, or 25.1.1.2 as soon as possible.

More Reading / Information

• https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US
• https://www.bleepingcomputer.com/news/security/cisa-warns-admins-to-immediately-fix-ivanti-flaw-exploited-as-zero-day/

Fortinet Patches Multiple Vulnerabilities

Fortinet has released patches for thirteen vulnerabilities, two of which are critical severity affecting FortiSIEM and FortiSandbox. The vulnerabilities, CVE-2026-106173 and CVE-2026-107656, allow an attacker to bypass authentication and execute arbitrary code. These patches also resolve four high-severity SQL injection vulnerabilities in multiple products that could allow authenticated attackers to execute arbitrary code.

Affected Versions

A full list of affected versions can be found here.

Recommendations

Apply the latest patches.

More Reading / Information

• https://www.fortiguard.com/psirt
• https://www.securityweek.com/citrix-fortinet-ivanti-patch-29-vulnerabilities-across-their-products/

Cisco Patches Critical Nexus Switch Vulnerabilities

Cisco has released patches for multiple critical vulnerabilities affecting Nexus 3000 and 9000 Series switches running NX-OS. Five vulnerabilities affecting NX-API, Next Generation OAM (NGOAM), and MPLS OAM could allow unauthenticated remote attackers to execute arbitrary code with root privileges or crash vulnerable switches, resulting in denial-of-service. Exploitation requires specific affected features to be enabled, and Cisco has not observed these vulnerabilities being exploited in the wild.

Affected Versions

Cisco Nexus 3000 and Nexus 9000 Series switches running vulnerable NX-OS releases with affected NX-API, NGOAM, or MPLS OAM features enabled.

Recommendations

Apply the latest patches.

More Reading / Information

• https://sec.cloudapps.cisco.com/security/center/publicationListing.x
• https://www.bleepingcomputer.com/news/security/cisco-warns-of-critical-flaws-allowing-nexus-switch-takeover/

Microsoft Patches 1,413 Vulnerabilities in October Patch Cycle

Microsoft has released 1,413 security patches, including 1,102 for vulnerabilities affecting Windows, 134 in Office, 61 in developer tools, and 36 in SharePoint Server. The most concerning vulnerability is CVE-2026-96951 (CVSS 8.8/10), an actively exploited Windows Shell flaw that allows attackers to bypass Mark of the Web (MotW) protections using a specially crafted file, potentially bypassing protections such as Defender SmartScreen and Office Protected View. Over 70 vulnerabilities are considered critical, with hundreds of privilege escalation and remote code execution vulnerabilities also addressed.

Affected Versions

A full list of affected versions can be found here.

Recommendations

Apply the latest patches.

More Reading / Information

• https://msrc.microsoft.com/update-guide/vulnerability
• https://www.securityweek.com/microsoft-patches-record-1413-vulnerabilities-including-exploited-windows-zero-day/

Adobe Patches 140 Vulnerabilities Across 10 Products

Adobe has released patches for roughly 140 vulnerabilities across products including ColdFusion, Commerce, Photoshop, Content Credentials SDK, and Substance 3D. ColdFusion received fixes for 32 vulnerabilities, including critical code execution and privilege escalation issues, while Adobe Commerce received 11 patches, including critical vulnerabilities that can be exploited without authentication for code execution or privilege escalation. Photoshop, Substance 3D, FrameMaker, Dimension, and Bridge also received fixes for numerous arbitrary code execution vulnerabilities. There are no reports of these vulnerabilities being exploited in the wild.

Affected Versions

A full list of affected versions can be found here.

Recommendations

Apply the latest patches.

More Reading / Information

• https://www.adobe.com/trust/security/bulletins-and-advisories.html
• https://www.securityweek.com/adobe-patches-140-vulnerabilities-across-10-products/

Recommendations

Please review your environment to ensure the above-mentioned issues are patched in a timely manner. It is security best practice to regularly update and/or patch software to the latest versions. The vulnerabilities above highlight the security benefits of limiting deployed software to “vendor-supported versions” only. This dramatically increases the likelihood that new vulnerabilities have a patch issued for them. Likewise, CyberMaxx strongly encourages maintaining an inventory of current software in your environment, which helps ensure and inform your patch and vulnerability management program.