Table of Contents

    Get Our Blogs Directly to Your Inbox, Every Friday

    Additional Resources:

    Ransomware Research Report | Q3 2026 – Audio Blog Interview

    Ransomware Research Report | Q3 2026 – Audio Blog Interview

    Blog Post

    4 min read

    HTTP2SHELL / NODE2SHELL

    HTTP2SHELL / NODE2SHELL

    Articles

    2 min read

    In this week’s Security Advisory

    • Critical Authentication Bypass Vulnerability in Oracle E-Business Suite
    • Critical GitLab Remote Code Execution Vulnerability
    • Critical Brotli Vulnerability Triggers Emergency Patches
    • Critical Unpatched RCE Vulnerability Disclosed in Linux tgt iSCSI
    • Cisco Patches 34 Vulnerabilities Across Multiple Products
    • HPE Patches Eight Maximum-Severity ArubaOS Vulnerabilities
    • Atlassian Patches 75 Vulnerabilities in Data Center and Server Products

    Critical Authentication Bypass Vulnerability in Oracle E-Business Suite

    Oracle E-Business Suite is an enterprise platform used to manage financial, supply chain, and other core business operations. The vulnerability, CVE-2026-101767 (CVSS 9.8/10), is an improper authentication issue in the Oracle Application Object Library (AOL) that allows an unauthenticated attacker with HTTP access to completely compromise the affected component without user interaction. Successful exploitation could give an attacker control over sensitive E-Business Suite data and application functionality. This vulnerability has been exploited in the wild.

    Affected Versions

    • Oracle E-Business Suite Application Object Library versions 12.2.3 through 12.2.15.

    Recommendations

    • Apply Oracle’s October 2026 Critical Patch Update

    More Reading / Information

    Critical GitLab Remote Code Execution Vulnerability

    GitLab has patched CVE-2026-110264 (CVSS 10/10), a maximum-severity vulnerability in its Regular Expression Compiler. The vulnerability is caused by an integer overflow issue that, under certain conditions, allows an unauthenticated attacker to execute arbitrary code on a GitLab server by submitting a specially crafted regular expression. GitLab.com and current GitLab Dedicated environments have already received the fix, but administrators of self-managed instances are being urged to patch immediately.

    Affected Versions

    • Multiple GitLab CE/EE branches prior to versions 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1.

    Recommendations

    • Upgrade self-managed GitLab servers to the latest patched release immediately.

    More Reading / Information

    Critical Brotli Vulnerability Triggers Emergency Patches

    CVE-2026-111497 (also tracked as Node2Shell, HTTP2Shell, Broccoli2Shell) is an out-of-bounds write in Brotli decoder software. Brotli is a tool that unpacks compressed data. The vulnerability allows attackers who can send specially crafted data to trick the software into writing code in memory spaces it shouldn’t have access to. The result can be a crash, leaked memory, or in some cases, remote code execution. It affects Node.js, Python’s Brotli packages, Bun, Envoy, .NET and other software that bundles the decoder. Of note, Microsoft has released emergency patches for the .NET implementation. No exploitation in the wild has been reported.

    Affected Versions

    • Node.js (including older versions)
    • Python’s Brotli add-ons
    • Bun
    • Envoy
    • .NET (only if Brotli features are on)
    • Any other software that bundles Brotli

    Recommendations

    • Multiple vendors have released patches. CyberMaxx urges updating and restarting applications with the dependency.
    • Upgrade to .NET 8.0.33, 9.0.22, 10.0.14, or .NET 11 Release Candidate 3 as applicable.

    More Reading / Information

    Critical Unpatched RCE Vulnerability Disclosed in Linux tgt iSCSI

    Linux SCSI Target Framework (tgt/tgtd) is open-source software used to enable network communication and storage. A researcher has disclosed multiple vulnerabilities that may be chained to achieve unauthenticated remote code execution as root on tgtd servers where CHAP authentication is disabled. The primary flaw is an unchecked buffer offset that enables attacker-controlled heap writes, while additional information disclosure flaws can potentially defeat ASLR and enable full system compromise. The researcher published proof-of-concept code, but no CVE has been assigned, and no patch was available at publication.

    Affected Versions

    • All Linux tgt/tgtd versions through 1.0.97 were reported as vulnerable.

    Recommendations

    • Do not expose iSCSI TCP/3260 to untrusted networks.
    • Enable CHAP authentication and restrict iSCSI access to explicitly authorized initiators while awaiting a vendor fix.

    More Reading / Information

    Cisco Patches 34 Vulnerabilities Across Multiple Products

    Cisco has released patches for 34 vulnerabilities affecting Expressway Series, Unified Communications, Snort 3, IOS XR, and several security products. The most severe include CVE-2026-76466, a critical vulnerability in Expressway that can allow arbitrary command execution as root, and multiple critical flaws in Unified Communications and Snort 3 that could lead to authentication bypass, code execution, and system compromise. Cisco reports no evidence that these vulnerabilities are being exploited in the wild.

    Affected Versions

    • A full list of affected Cisco products can be found here.

    Recommendations

    • Apply the latest patches.

    More Reading / Information

    HPE Patches Eight Maximum-Severity ArubaOS Vulnerabilities

    HPE has released security updates addressing 72 vulnerabilities in ArubaOS (it’s networking management software), including eight maximum-severity authentication bypass, command injection, SQL injection, and buffer overflow flaws. The eight critical vulnerabilities affect AOS-8 and AOS-10 and can be remotely exploited without authentication, with several leading directly to remote code execution. HPE reports no evidence of active exploitation or publicly available exploit code.

    Affected Versions

    • Multiple ArubaOS 8 and ArubaOS 10 releases used by Aruba access points, controllers, gateways, and mobility infrastructure.

    Recommendations

    • Apply HPE’s latest ArubaOS security updates.

    More Reading / Information

    Atlassian Patches 75 Vulnerabilities in Data Center and Server Products

    Atlassian’s October security bulletin addresses 75 unique vulnerabilities in third-party components used across Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, Jira Software, and Jira Service Management. Six vulnerabilities are rated critical, affecting different components including Apache Tomcat, Bouncy Castle, Netty, and Apache SSHD. While the remaining high-severity flaws include denial-of-service, authentication, SSRF, information disclosure, and code execution vulnerabilities. Atlassian says its implementation of the critical third-party components presents a lower risk to customers and there are no reports of active exploitation.

    Affected Versions

    • A full list of affected versions can be found here.

    Recommendations

    • Apply the latest patches.

    More Reading / Information

    Recommendations

    Please review your environment to ensure the above-mentioned issues are patched in a timely manner. It is security best practice to regularly update and/or patch software to the latest versions. The vulnerabilities above highlight the security benefits of limiting deployed software to “vendor-supported versions” only. This dramatically increases the likelihood that new vulnerabilities have a patch issued for them. Likewise, CyberMaxx strongly encourages maintaining an inventory of current software in your environment, which helps ensure and inform your patch and vulnerability management program.