Drupal Commerce, GitLab and Cisco: critical flaws exploited

Between October 28 and 29, attacks were confirmed against online stores built with Drupal Commerce, GitLab servers and Cisco firewalls with VPN. Fixed versions and what to check.

Between October 28 and 29, 2026, real attacks were confirmed against three critical flaws in software widely used by businesses: online stores built with Drupal Commerce, self-managed GitLab servers and Cisco firewalls with VPN. A fixed version already exists in all three cases, so the priority is to update before these exploited flaws reach your systems.

Drupal Commerce: online stores

On October 28, Drupal published advisory SA-CONTRIB-2026-254 for Commerce Core (CVE-2026-118539), the e-commerce module used by more than 42,000 sites. The flaw, rated highly critical (21 out of 25), lets a visitor who is not logged in bypass the access controls of certain routes and fields, with a possible financial impact on the store. Drupal confirmed it is already being exploited.

Affected versions: those earlier than 8.x-2.41 and 3.x versions earlier than 3.3.13.
Fix: Commerce Core 3.3.13, or 8.x-2.41 for the older branch.
Also: review recent orders for inconsistencies, as Drupal recommends.

GitLab: code servers

CVE-2026-97229 is an integer overflow in the CI/CD regular expression compiler that lets an unauthenticated attacker run code on the server. It has the maximum severity, 10 out of 10. GitLab fixed it on October 12 and CISA confirmed attacks on October 29. When the patch came out, Censys counted 25,766 internet-exposed servers running vulnerable versions.

Affected: self-managed GitLab CE and EE installations from 19.2.0 to 19.2.7, 19.3.0 to 19.3.4 and 19.4.0 to 19.4.1. GitLab.com is already protected.
Fix: 19.2.8, 19.3.5 or 19.4.2. The update includes database changes, so single-node servers need a scheduled maintenance window.
The flaw lies in Ruby's regular expression engine, which the Ruby project fixed on October 23 in versions 4.0.9, 3.4.12 and 3.3.13. CISA warns that other products that use it may be affected: if you run Ruby applications, update Ruby too.

Cisco ASA and FTD: firewalls with VPN

CVE-2026-76418, rated high severity (8.6 out of 10), affects Cisco ASA and Firepower Threat Defense firewalls that have SSL VPN enabled and secondary authentication on a tunnel group. With a crafted request and no credentials, an attacker reboots the device and leaves the company without VPN. Cisco published its advisory on October 28 and confirmed the flaw is already being exploited, and CISA added it to its catalog of exploited vulnerabilities the next day.

Fix: ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 or 9.24.1.27, and FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 or 10.1.1, depending on your device's release train (Cisco's advisory has the full table).
While you update: Cisco states there are no workarounds, but there is a temporary mitigation. If the DefaultWEBVPNGroup does not use secondary authentication, disable the group list (no tunnel-group-list enable); if it does, remove it (no secondary-authentication-server-group). Cisco warns that this lowers the security of remote access VPN, so it should only be temporary.

What to do at your company

Take inventory: does your store use Drupal Commerce? Do you run your own GitLab? Does your VPN run on a Cisco firewall?
Apply the fixed versions this week, starting with whatever is exposed to the internet.
Review logs, users and orders since the beginning of October.

October 31 update: data from the official advisories

We checked this article against the Drupal, GitLab, Cisco and CISA advisories. We removed the figure for exposed Cisco firewalls and replaced the GitLab server count with Censys's measurement, because only media outlets had published them. We also added Cisco's fixed releases, clarified its temporary mitigation and included the Ruby fix, which shares GitLab's flaw.

How we help you

Our software development team updates and tests Drupal stores and GitLab servers without disrupting operations, and our network design and implementation team updates firewalls and VPNs in scheduled windows. To review your case, contact us.