The Exploit Bulletin — Friday, October 30, 2026: 5 issues require action
Friday, October 30, 2026 — 5 issues require action. If you run none of the software below, you are done.
Affects: GitLab CE/EE · Drupal Commerce Core · YOOtheme Pro extension for Joomla · Cisco Catalyst SD-WAN · TightVNC
1. Unauthenticated RCE via crafted regular expression in GitLab CI/CD configuration (CVE-2026-97229)
CISA KEV (due 2026-11-01) · REMOTE CODE EXECUTION · CRITICAL · CVSS 10.0
CISA added this flaw to KEV on 2026-10-29 with a remediation deadline of 2026-11-01, Alpine Linux has disclosed an attempted exploitation against its own GitLab server, and four public exploits are in VulnCheck XDB, so an unpatched instance reachable by untrusted users is a server waiting to be taken over.
An integer overflow in GitLab's regular-expression handling lets an unauthenticated user execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration, because the regex is insufficiently validated. Successful exploitation gives the attacker control of the GitLab host and everything it stores: source, pipelines, secrets and tokens.
Affected: GitLab CE/EE 19.2.0 – 19.2.7 (fixed in 19.2.8); GitLab CE/EE 19.3.0 – 19.3.4 (fixed in 19.3.5); GitLab CE/EE 19.4.0 – 19.4.1 (fixed in 19.4.2)
How to Test: Check the running GitLab version (Admin Area or the /help page on the instance) against the fixed releases 19.2.8, 19.3.5 and 19.4.2; anything in 19.2, 19.3 or 19.4 below those is vulnerable. If the instance was exposed before patching, review recently pushed or modified CI/CD configuration files for unusual regular-expression content, inspect GitLab and Rails application logs around CI pipeline processing for crashes or anomalies, and look for unexpected processes, users, tokens or files on the GitLab server. Alpine Linux's incident write-up (alpinelinux.org, 2026-10-28) describes an attempted exploitation on their instance and is a useful reference for what to look for.
How to Patch: Upgrade GitLab to 19.2.8, 19.3.5 or 19.4.2 (or later) per GitLab's 19.4.2 patch release. The fix includes the regexp changes shipped by Ruby on 2026-10-23 for the GitLab CVEs; if you cannot upgrade immediately, restrict who can reach the instance and who can push CI/CD configuration until the patch is applied.
Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · CISA alert: added to KEV based on evidence of active exploitation · Canadian Centre for Cyber Security AV26-1028 Update 1 · The Hacker News on KEV addition
2. Missing route and field access checks in Drupal Commerce Core allow order tampering (CVE-2026-118539)
AUTHENTICATION BYPASS · HIGH
Drupal published SA-CONTRIB-2026-254 saying the flaw is being exploited, so shops that don't upgrade risk tampered orders and direct financial loss.
Drupal Commerce Core does not properly protect some routes and entity fields. Attackers can get past access controls and change commerce data in ways that cost the merchant money. Drupal rates the issue Highly critical (21/25) and says it needs no special access conditions.
Affected: Drupal Commerce Core < 8.x-2.41; Drupal Commerce Core >= 3.0.0 < 3.3.13
How to Test: Check the installed Commerce Core (project machine name: commerce) version on the Drupal Extend/Update status page or in composer.lock. Any version below 8.x-2.41 on the 2.x branch, or from 3.0.0 up to but not including 3.3.13, is vulnerable. Following Drupal's advice, audit recent orders for inconsistencies such as unexpected prices, totals, or order states, and review web access logs for unusual requests to commerce routes.
How to Patch: Sites on 3.x should upgrade to Commerce Core 3.3.13. Sites on earlier versions should upgrade to Commerce Core 8.x-2.41.
Evidence: VulnCheck KEV · Vendor confirmed · The Hacker News: Hackers actively exploit Drupal Commerce Core authorization bypass
3. Unauthenticated PHP file write via signed image transformation handler in YOOtheme Pro for Joomla (CVE-2026-102785)
PUBLIC EXPLOIT · NO ATTACKS CONFIRMED · REMOTE CODE EXECUTION · CRITICAL · CVSS 10.0
Three public exploits for this unauthenticated remote code execution flaw are in VulnCheck XDB and VulnCheck listed the CVE on 2026-10-27; no attacks are confirmed in published reports, but any public site on YOOtheme Pro 5.0.0–5.0.52 can be compromised with nothing more than one of its own image URLs.
YOOtheme Pro's publicly reachable image transformation handler does not fully bind the normalized image operations and output path to its request signature. An unauthenticated attacker can reuse a signature exposed in any legitimate public image URL, add extra operations, traverse out of the cache directory and write a PNG/PHP polyglot into an executable public media directory, gaining code execution on the web server.
Affected: YOOtheme Pro extension for Joomla 5.0.0 – 5.0.52; Patchstack lists the YOOtheme Pro theme for WordPress 5.0.0 – 5.0.52 for the same arbitrary file upload issue
How to Test: Check the installed YOOtheme Pro version in the Joomla extension manager (or the WordPress theme list); 5.0.0 through 5.0.52 is affected. To check for compromise, search the site's public media and cache directories for recently written .php files or PNG files containing PHP code, and review web server access logs for requests to the image transformation handler that carry path-traversal sequences or extra image operations appended to otherwise legitimate signed image URLs.
How to Patch: Update YOOtheme Pro to a release newer than 5.0.52 through the YOOtheme updater. Until the update is applied, block or restrict access to the image transformation handler at the web server or WAF, and ensure the public media directories cannot execute PHP.
Evidence: VulnCheck KEV · VulnCheck XDB public exploit · VulnCheck XDB public exploit · VulnCheck XDB public exploit
4. Volt Typhoon 'Silent Train' zero-day exploitation of SD-WAN and IT-management platforms (Cisco Catalyst SD-WAN)
UNVERIFIED PUBLIC REPORT · NO CVE · REMOTE CODE EXECUTION · CRITICAL
Credible reporting attributes active exploitation of these zero-days to Volt Typhoon, a nation-state actor targeting edge and management infrastructure.
A Reddit summary of Lumen Black Lotus Labs research, corroborated by SecurityWeek, BleepingComputer and SecurityAffairs, attributes exploitation of at least four zero-days in edge and IT-management platforms to China-linked Volt Typhoon, which routes attacks through a rotating relay network ('Silent Train') of compromised VPS and SOHO/IoT gear. Named affected products and fixed builds include Cisco Catalyst SD-WAN (20.9.8.2/20.12.5.3/20.12.6.1/20.15.4.2/20.18.2.1), VeloCloud Orchestrator (5.2.3.14/6.1.3.4/6.4.2.4/7.0.0.1), N-able N-central (2025.3.1 / 2024.6 HF2), Versa Director (22.1.4+) and Quest KACE SMA (October 2025 updates). Specific CVEs and per-product technical detail are not stated in the post.
Affected: Cisco Catalyst SD-WAN before 20.9.8.2 / 20.12.5.3 / 20.12.6.1 / 20.15.4.2 / 20.18.2.1
How to Test: Inventory all VeloCloud Orchestrator, Catalyst SD-WAN Controller/Manager/Validator, N-able N-central, Versa Director and KACE SMA instances (including MSP-operated) and compare installed builds against the fixed versions listed; review management-plane access logs for anomalous sessions originating from relay/VPS and SOHO IP ranges.
How to Patch: Apply the vendor fixed builds for each product and isolate the management interfaces from the internet.
Evidence: Reddit summary of Silent Train report · SecurityWeek on Volt Typhoon SD-WAN zero-days · BleepingComputer on Silent Train
5. Pre-auth server-to-viewer heap write enabling RCE in listening mode (TightVNC Viewer)
UNVERIFIED PUBLIC REPORT · NO CVE · REMOTE CODE EXECUTION · HIGH
A complete working exploit is public and the fix shipped without a security note, so operators may be unaware they are running a vulnerable build.
SSD Secure Disclosure published a full write-up and exploit for a pre-authentication RCE in the TightVNC viewer. The viewer computes the framebuffer allocation size in a 32-bit int, so a malicious server announcing 32768x32769 at 32bpp wraps the allocation to 128 KB while keeping the 4 GB logical canvas; unchecked 32-bit pointer arithmetic then yields a server-controlled write at arbitrary offsets, chained to a leak and ROP for code execution. In listening mode (tvnviewer.exe -listen, binding 0.0.0.0:5500 with no password) this is reachable over the network with no user action. SSD says the vendor silently patched on 2026-10-03 without a security note and never responded; no CVE is assigned. Source is not on the allowlist.
Affected: TightVNC 2.8.88 x64
How to Test: Check viewer version via Help > About for 2.8.88 (x64); determine whether listening mode is enabled (tvnviewer.exe -listen or the GUI Listening Mode) and whether TCP/5500 is exposed. No indicators of compromise are provided in the report.
How to Patch: Install the current TightVNC viewer release that includes the 2026-10-03 fix; as interim mitigation stop using listening mode and restrict/ block inbound TCP/5500.
Evidence: SSD Secure Disclosure write-up and exploit
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
