Audience: Vulnerability Managers, Security Operations, CISOs, DevSecOps Teams
Reading Time: Approximately 10 minutes

Subscribe to get these articles directly to your inbox when published

This Week's KEV Additions

Note: EPSS scores are as published by FIRST.org at time of writing and are not updated after publication; scores change daily.

Analysis

CVE-2026-11852 — Ivanti Connect Secure

• What it is: Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content.

• Affected versions: Refer to official Ivanti advisory.

• Exploitation status: Confirmed active exploitation (CISA KEV).

• Patch available: Yes, apply vendor updates.

• CISA due date: 2026-11-20

• Operational risk: Potential arbitrary file uploads on VPN infrastructure, risking perimeter security compromise.

CVE-2026-11135 — Ivanti Connect Secure

• What it is: Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate privileges.

• Affected versions: Refer to official Ivanti advisory.

• Exploitation status: Confirmed active exploitation (CISA KEV).

• Patch available: Yes, apply vendor updates.

• CISA due date: 2026-11-20

• Operational risk: Privilege escalation allowing low-privileged local users to acquire administrative control.

CVE-2026-97229 — GitLab Community/Enterprise Edition

• What it is: GitLab contains an integer overflow or wraparound vulnerability allowing unauthenticated remote code execution via specially crafted requests.

• Affected versions: Refer to GitLab security release advisory.

• Exploitation status: Confirmed active exploitation.

• Patch available: Yes.

• CISA due date: 2026-11-19

• Operational risk: Complete compromise of the GitLab server instance, risking source code exposure and CI/CD pipeline tampering.

CVE-2026-76418 — Cisco Secure Firewall ASA / FTD

• What it is: Cisco Secure Firewall contains an unchecked return value to NULL pointer dereference vulnerability causing denial of service or remote code execution.

• Affected versions: Cisco ASA Software and FTD Software versions noted in advisory.

• Exploitation status: Confirmed active exploitation.

• Patch available: Yes.

• CISA due date: 2026-11-19

• Operational risk: Disruption of core network perimeter controls and firewall crash/downtime.

CVE-2026-46300 — Linux Kernel

• What it is: Linux Kernel contains a missing initialization of a variable vulnerability allowing unintended modification of page-cache-backed data.

• Affected versions: Vulnerable Linux kernel releases.

• Exploitation status: Active exploitation in the wild.

• Patch available: Yes, update kernel packages.

• CISA due date: 2026-11-18

• Operational risk: Local data tampering and potential system integrity compromise.

CVE-2026-41709 — Broadcom VMware ESX

• What it is: VMware ESX contains an insufficient logging vulnerability allowing administrative actors to perform operations without audit logs.

• Affected versions: Refer to Broadcom security advisory.

• Exploitation status: Active exploitation in the wild.

• Patch available: Yes.

• CISA due date: 2026-11-18

• Operational risk: Evasion of security auditing and undetected malicious administrative actions.

CVE-2026-48356 — Adobe Commerce and Magento

• What it is: Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability leading to arbitrary code execution.

• Affected versions: Adobe Commerce versions prior to security patch level.

• Exploitation status: Actively exploited.

• Patch available: Yes.

• CISA due date: 2026-11-17

• Operational risk: Web store compromise, customer data theft, and payment skimming deployment.

CVE-2026-11149 — Google Brotli

• What it is: Google Brotli contains an unchecked return value vulnerability allowing remote memory corruption and sensitive data disclosure.

• Affected versions: Unpatched Brotli library versions.

• Exploitation status: Active exploitation.

• Patch available: Yes.

• CISA due date: 2026-11-17

• Operational risk: Widespread library exposure leading to service crashes and memory disclosure across dependent applications.

CVE-2026-109619 — PHP Group PHP

• What it is: PHP contains a stale internal request-state vulnerability allowing unauthenticated remote code execution.

• Affected versions: Vulnerable PHP runtime branches.

• Exploitation status: Active exploitation (Extremely high EPSS 99.999%).

• Patch available: Yes.

• CISA due date: 2026-11-16

• Operational risk: Direct unauthenticated remote code execution on web application servers hosting PHP.

CVE-2026-109618 — PHP Group PHP

• What it is: PHP contains an out-of-memory corruption vulnerability allowing unauthenticated remote code execution.

• Affected versions: Vulnerable PHP runtime branches.

• Exploitation status: Active exploitation (Extremely high EPSS 99.999%).

• Patch available: Yes.

• CISA due date: 2026-11-16

• Operational risk: Critical memory corruption resulting in server takeover and widespread application compromise.

Exploitation Context

This week’s CISA KEV additions feature a heavy concentration of critical remote code execution and memory corruption flaws impacting core enterprise infrastructure components, web development frameworks, and foundational libraries. Web servers running PHP and compression engines such as Google Brotli are seeing maximum exploitation probability scores (EPSS nearing 100%), signaling automated exploitation in the wild by threat actors targeting web perimeters.

Additionally, edge networking equipment and developer tooling (Ivanti Connect Secure, Cisco Secure Firewall, and GitLab) continue to be prime targets for initial access and lateral movement. Security teams must prioritize patching runtime environments and perimeter gateways to thwart active exploitation campaigns.

Remediation Priorities

Detection and Monitoring Guidance

• CVE-2026-11852 (Ivanti):

  • Log Sources: Ivanti Connect Secure access logs, web server request logs, system audit logs.

  • Behavioral Indicators: Unauthorized or anomalous file upload attempts, unexpected file creation in web-accessible directories, predictable session or identifier patterns.

  • Monitoring Gap / Detection Artifacts: Encrypted HTTPS traffic targeting administrative endpoints can obscure malicious payloads unless decrypted at a WAF or inspection proxy.

• CVE-2026-11135 (Ivanti):

  • Log Sources: Local authentication logs, privilege escalation logs, command-line auditing on appliance shells.

  • Behavioral Indicators: Low-privileged authenticated users executing sensitive administrative binaries or accessing restricted system functions.

  • Monitoring Gap / Detection Artifacts: Lack of granular process auditing on local appliance shells can conceal internal privilege changes.

• CVE-2026-97229 (GitLab):

  • Log Sources: GitLab production logs (api_json.log, production_json.log), web server access logs, container execution logs.

  • Behavioral Indicators: Specially crafted unauthenticated requests causing integer overflows, unexpected application crashes, or unauthorized process spawning from the GitLab service account.

  • Monitoring Gap / Detection Artifacts: Standard web logs may not capture deep application-layer memory or calculation anomalies without specialized runtime application self-protection (RASP).

• CVE-2026-76418 (Cisco):

  • Log Sources: Cisco ASA/FTD system syslog, crash dumps, core files, and connection logs.

  • Behavioral Indicators: Sudden device reboots, recurring NULL pointer dereference crash logs, or dropped connections originating from untrusted external IPs.

  • Monitoring Gap / Detection Artifacts: Denial-of-service impacts manifest as sudden traffic drops rather than distinct forensic artifacts unless core dump analysis is performed.

• CVE-2026-46300 (Linux):

  • Log Sources: Kernel ring buffer (dmesg), auditd logs, system integrity monitoring alerts.

  • Behavioral Indicators: Unintended modification of page-cache-backed data, anomalous local process memory interactions.

  • Monitoring Gap / Detection Artifacts: Low-level kernel memory manipulation often leaves minimal user-space logging without advanced kernel auditing configurations.

• CVE-2026-41709 (Broadcom):

  • Log Sources: VMware vCenter audit logs, ESXi host logs, authentication records.

  • Behavioral Indicators: Administrative operations executed without corresponding audit records or gaps in expected system log timelines.

  • Monitoring Gap / Detection Artifacts: By nature of insufficient logging, successful exploitation specifically suppresses telemetry, requiring host-based behavioral correlation.

• CVE-2026-48356 (Adobe):

  • Log Sources: Web server access/error logs, application upload directory monitors, file integrity monitoring (FIM).

  • Behavioral Indicators: Unrestricted file uploads containing executable code extensions within media or upload paths, subsequent execution by the web user context.

  • Monitoring Gap / Detection Artifacts: Obfuscated filenames or double extensions can bypass basic content-type inspection filters.

• CVE-2026-11149 (Google):

  • Log Sources: Application crash dumps, runtime memory error logs, WAF compression traffic logs.

  • Behavioral Indicators: Decoder state corruption, unexpected segmentation faults or memory disclosure in services utilizing Brotli.

  • Monitoring Gap / Detection Artifacts: Embedded compression libraries within larger software packages can make dependency tracking and vulnerability visibility difficult.

• CVE-2026-109619 / CVE-2026-109618 (PHP Group):

  • Log Sources: PHP-FPM logs, web server error logs, network IDS/IPS alerts for remote code execution signatures.

  • Behavioral Indicators: Unauthenticated HTTP requests triggering anomalous process spawns, memory corruption symptoms, or anomalous outbound network traffic from PHP worker processes.

  • Monitoring Gap / Detection Artifacts: Polymorphic payloads and encrypted TLS sessions can hide exploitation attempts if SSL decryption and deep packet inspection are absent.

Hackerstorm Analysis

Organizations are urged to review all exposure across perimeter PHP applications and infrastructure management endpoints. Threat actors are rapidly leveraging high-EPSS vulnerabilities to automate compromise before defenders can complete standard patching cycles. Utilize continuous vulnerability scanning and IDS/IPS rule tuning to catch exploitation attempts early.

What you should do next

Ensure you understand the latest KEV additions to cover off any potential gaps in your remediation activities.  View all weekly reports here

Further Reading

The following resources offer technical analysis to help integrate CISA KEV data into operational triage workflows and stay aligned with updated mitigation guidance.

About This Report

Attribution Note

This analysis is based on publicly available reporting and security research summaries. Some technical details may change as additional information becomes available. 

Author Information

Timur Mehmet | Founder & Lead Editor

Timur is a veteran Information Security professional with a career spanning over three decades. Since the 1990s, he has led security initiatives across high-stakes sectors, including Finance, Telecommunications, Media, and Energy. Professional qualifications over the years have included CISSP, ISO27000 Auditor, ITIL and technologies such as Networking, Operating Systems, PKI, Firewalls. For more information including independent citations and credentials, visit our About page.

Contact: This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Standards

This article adheres to Hackerstorm.com's commitment to accuracy, independence, and transparency:

• Fact-Checking: All statistics and claims are verified against primary sources and authoritative reports
• Source Transparency: Original research sources and citations are provided in the References section below
• No Conflicts of Interest: This analysis is independent and not sponsored by any vendor or organization
• Corrections Policy: We correct errors promptly and transparently. Report inaccuracies to This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Policy: Ethics, Non-Bias, Fact Checking and Corrections

Learn More: About Hackerstorm.com | FAQs

Source Transparency

Analyst Notes

• No ransomware attribution was publicly associated with this week's KEV additions at the time of publication.
• No confirmed threat actor attribution was available beyond CISA's confirmation of active exploitation for the majority of entries.
• Where vendor advisory details or EPSS values were unavailable at publication time, placeholders were retained pending analyst validation and vendor updates prior to final publication.