This Week in Business IT: Ivanti Flaws Under Attack

AfD domain breach — 345,439 accounts exposed

Have I Been Pwned added a breach tied to the afd.de domain, dated 2026-09-09 and added to the database 2026-10-27, affecting 345,439 accounts. The exposed data includes email addresses and email message content. Source: Have I Been Pwned.

This is a German political party's domain, so direct exposure for Texas businesses is low. The practical risk is indirect: employees who reused a work email address to sign up for a newsletter, forum, or political mailing list years ago often don't remember it, and that old account becomes a stepping stone for phishing or credential-stuffing attempts against your business accounts. If you haven't run your company's domain through a breach-monitoring service lately, this is a good week to do it. A dark web monitoring service catches this kind of exposure automatically instead of relying on an employee to notice a breach notification email months later.

Ivanti Connect Secure — two new CVEs, both under active exploitation

CISA added CVE-2026-118527 (generation of predictable numbers or identifiers) on 2026-10-30 with a federal remediation deadline of 2026-11-13, and CVE-2026-111357 (missing authentication for a critical function) on the same day with a much tighter deadline of 2026-11-02. Ivanti Connect Secure sits at the perimeter of your network, so a flaw like this can let an attacker bypass login entirely. We've got a full technical breakdown at our Ivanti Connect Secure guide. If your business runs Connect Secure as a remote-access VPN, treat this as urgent — patch this week, not next month. This is exactly the kind of gap a vulnerability assessment is built to catch before CISA does it for you.

GitLab Community Edition and Enterprise Edition — integer overflow

Added 2026-10-29 with a federal due date of 2026-11-01, CVE-2026-97229 affects GitLab CE and EE. If your development team self-hosts GitLab for source control or CI/CD pipelines, confirm you're on a patched release. If you use GitLab.com's hosted version, this is largely handled for you, but it's worth a quick confirmation email to your dev lead rather than an assumption.

Cisco Secure Firewall ASA and Secure FTD — null pointer dereference

CVE-2026-76418 was added 2026-10-29 with a 2026-11-01 federal deadline. This affects Cisco ASA and Firepower Threat Defense devices, both common choices for mid-size Texas businesses running their own firewall hardware. An unchecked return value leading to a null pointer dereference can crash the device or open a path for further exploitation. If Cisco ASA or FTD sits at your perimeter, check firmware versions against Cisco's advisory now. This is squarely the kind of asset your network infrastructure partner should already be tracking without you having to ask.

Broadcom VMware ESX — insufficient logging

Added 2026-10-28, federal due date 2026-11-11, CVE-2026-41709 is a logging gap in VMware ESX. On its own it's not a remote-code-execution flaw, but insufficient logging means that if something else goes wrong on your hypervisor, you may not have the forensic trail to figure out what happened or prove what didn't. If your virtualization environment runs ESX, get this patched before it becomes relevant during an incident response engagement rather than after.

Linux Kernel — missing variable initialization

CVE-2026-46300 was added 2026-10-28 with an already-passed federal deadline of 2026-10-31. Details are in our Linux Kernel CVE guide. Most small businesses don't manage kernel patching directly, but if you run any self-hosted Linux servers, appliances, or containers, confirm your distribution has shipped a fix and that your patching cadence actually applied it.

Adobe Commerce and Magento — dangerous file upload

CVE-2026-48356, added 2026-10-27 with a 2026-11-10 federal deadline, allows unrestricted upload of dangerous file types on Adobe Commerce and Magento storefronts. If your business runs e-commerce on either platform, this is a direct line to a web shell and a defaced or hijacked storefront. Patch this one before the holiday shopping season ramps up traffic to your site.

Google Brotli — unchecked return value

Added 2026-10-27 with a 2026-11-10 deadline, CVE-2026-111497 affects the Brotli compression library, which is embedded in countless web servers, browsers, and applications. For most small businesses this needs no direct action — it gets fixed as part of normal browser and OS updates. Worth knowing it's out there, not worth losing sleep over.

PHP — two memory and request-state vulnerabilities

CVE-2026-109618 and CVE-2026-109619, both added 2026-10-26 with a 2026-10-29 federal deadline, affect PHP's memory handling and internal request-state tracking. Details on both are covered in our PHP vulnerability guide. If your website or line-of-business application runs on PHP — and a large share of small business sites do — confirm with your hosting provider or developer that the patched version is deployed.

Ten KEV additions and a breach notice in one week isn't an outlier anymore; it's close to the baseline pace. The businesses that handle this well aren't the ones scrambling after each CISA update — they're the ones with continuous vulnerability scanning and threat monitoring already running, so patches like these get triaged and applied as part of a normal week rather than a fire drill. If a patch does get missed and something slips through, having an incident response plan ready beforehand is the difference between a bad afternoon and a bad quarter — our first-72-hours guide walks through what that looks like.

For a plain-English rundown on patching basics, phishing recognition, and password hygiene you can hand to your whole team, check out LayerLogix Academy and the security training track specifically. If you'd rather have someone confirm your current exposure to this week's CISA list instead of cross-checking it yourself, request a free IT assessment and we'll tell you exactly where you stand.