Threat Analysis: Ivanti Zero-Days, FortiMail RCE, and GitLab Under Active Attack, 2nd November 2026
This is your Daily Threat Analysis for the 2nd of November 2026.
Three items deserve your attention this morning, and they share a common thread: all three involve products sitting at the edge of networks, the remote access gateway, the mail security appliance, the code repository. When attackers compromise infrastructure at this layer, they are inside the perimeter before most endpoint defences have anything to act on. There are no alerts because there is no anomaly yet. There is just an attacker with valid access.
Let us go through them in order of operational severity.
Ivanti Connect Secure: Two Zero-Days Chained in Active Attacks Since October
Ivanti has released patches for two new vulnerabilities in Connect Secure, its widely deployed SSL VPN gateway product, after confirming the flaws have been chained together in active attacks since at least the 1st of October 2026.
The two flaws were exploited in sequence: one to gain initial access, the second to escalate privileges on the underlying system. Ivanti published the security updates on the 2nd of November. That means there is a five-week window, at minimum, during which organisations running unpatched Connect Secure gateways were exposed to a working exploit chain with no vendor patch available.
Ivanti Connect Secure sits at the network edge as the primary remote access mechanism for a large number of UK organisations, professional services firms, NHS supply chain contractors, local government agencies, and SMBs that consolidated their remote access infrastructure onto a single appliance. If your organisation or your managed IT provider uses Ivanti Connect Secure, the question is not whether to patch. The question is whether you were compromised during the period when no patch existed.
The advisory attributes exploitation to what is described as a sophisticated threat actor. What the advisory does not say, and what you should factor into your response, is that Ivanti Connect Secure has been a persistent target for state-sponsored actors, particularly those with an interest in network persistence and long-dwell-time access. Previous Ivanti Connect Secure campaigns resulted in implants that survived factory resets. That context is worth keeping in mind when assessing your incident response posture.
What to do:
- Apply the patches Ivanti released on the 2nd of November immediately. Do not schedule this for next week’s change window.
- If you cannot patch immediately, review your Ivanti Connect Secure logs for anomalous authentication events, unusual outbound connections, and any evidence of configuration changes you did not make.
- Consider whether your gateway was exposed during the October window. If you cannot definitively rule out compromise, treat the device as potentially implanted and engage your incident response process.
- If an MSP manages this device on your behalf, ask for written confirmation of patch status and a log review by end of day today.
FortiMail: Unauthenticated Arbitrary File Write, Actively Exploited (CVE-2026-104286)
Fortinet’s PSIRT has published an advisory for a critical path traversal vulnerability in FortiMail, tracked as CVE-2026-104286, which is actively exploited in the wild.
The mechanics are straightforward and severe: a path traversal flaw combined with improper NULL byte neutralisation allows an unauthenticated attacker to write arbitrary files to the underlying system through crafted HTTP or HTTPS requests. No authentication required. No user interaction required. The attacker sends a request, writes a file, and from there the path to full system compromise is a well-understood exercise.
Affected versions span a wide range of currently deployed FortiMail builds:
- FortiMail 8.0.0 through 8.0.1
- FortiMail 7.6.0 through 7.6.6
- FortiMail 7.4.0 through 7.4.8
- FortiMail 7.2.0 through 7.2.9
FortiMail is not a niche product. It is the email security appliance of choice for a significant portion of UK organisations in professional services, public sector supply chains, and mid-market businesses that consolidated their mail security onto a dedicated gateway. Many of these deployments are managed by MSPs who run FortiMail on behalf of multiple clients. That means a single unpatched instance in a managed services environment potentially represents exposure across multiple downstream organisations.
The NCSC has previously published guidance on securing network edge devices and has specifically highlighted Fortinet products in advisory context. The fact that unauthenticated file write vulnerabilities in mail gateways continue to be discovered and actively exploited is a structural problem with how these appliances are deployed and maintained, they are often treated as set-and-forget infrastructure rather than the internet-facing systems they are.
What to do:
- Check your FortiMail version against the affected ranges above. Fortinet’s PSIRT advisory at FG-IR-26-175 contains the patched versions.
- Apply the available patches immediately. This vulnerability requires no authentication, which means internet-exposed FortiMail instances are being scanned and targeted right now.
- If you cannot patch immediately, consider whether you can restrict management interface access to trusted IP ranges as a partial mitigation. This does not address the vulnerability in mail processing itself, but it reduces the attack surface for management-plane exploitation.
- If this device is managed by an MSP, escalate to them today with the CVE reference and ask for confirmation of remediation timeline.
GitLab: Over 1,000 Servers Still Exposed to Maximum-Severity RCE
Shadowserver data indicates that over 1,000 internet-exposed GitLab servers remain unpatched against a maximum-severity remote code execution vulnerability, which is actively being exploited in attacks.
The real-world consequence of this is not theoretical. Alpine Linux confirmed that on the 20th and 21st of October 2026, attackers attempted to exploit this very vulnerability against its GitLab-based development infrastructure. Alpine Linux responded by rebuilding its entire GitLab server from scratch and resetting all passwords, a significant operational response that tells you something about the confidence level in the integrity of a partially-compromised GitLab instance.
The SMB relevance here is supply chain risk, not just direct exposure. Most small businesses do not run their own GitLab instance. But the software they use, the plugins they install, the open-source components in their supply chain, those may have been built on infrastructure that does. If a development project’s GitLab server is compromised, the question of whether malicious code could be introduced into a build pipeline is not paranoia. It is a documented attack pattern.
For the UK businesses that do run GitLab, software development agencies, IT consultancies, digital product firms, the position is clear: if your GitLab instance is internet-exposed and unpatched, you are in the same category as the 1,000-plus servers Shadowserver has already identified. The patch has been available. The exploitation is active. The calculation is not complicated.
What to do:
- Check whether your GitLab instance is internet-exposed. If it does not need to be, restrict it behind a VPN or firewall rule immediately.
- Apply the available security update. GitLab has published the fix.
- Review your GitLab access logs for the period from the 20th of October onwards for evidence of unusual access patterns, failed authentication bursts, or unexpected repository changes.
- If your business uses software built or maintained by third-party developers, it is reasonable to ask whether their development infrastructure has been reviewed. This is not an unreasonable vendor security question.
Also on the Radar Today
Two items worth a shorter note for context.
C3RB3R Ransomware Targeting Synology NAS Devices: Synology has warned customers of a surge in C3RB3R ransomware attacks targeting network-attached storage appliances. NAS devices are common in UK SMB environments, used for local backups, file sharing, and media storage. If you have a Synology NAS, update its firmware immediately and verify that it is not directly exposed to the internet. Ransomware hitting backup infrastructure is a specific category of pain: it removes the recovery option at the same time as the primary data.
WordPress Credential Theft Toolkit (TIKTOUK): Security researchers have documented a multi-component toolkit actively targeting WordPress installations to extract credentials, database configurations, AWS keys, and SMTP plugin credentials. The toolkit probes for exposed configuration files, extracts secrets from client-side code, and decrypts stored SMTP passwords. If your business runs a WordPress site, and a substantial proportion of UK SMB websites do, ensure your WordPress installation is updated, your configuration files are not publicly accessible, and you are not storing AWS or cloud credentials in your WordPress configuration. The full SpiderLabs analysis is worth reviewing if WordPress is part of your infrastructure.
The Common Thread
Four of today’s significant items, Ivanti Connect Secure, FortiMail, GitLab, and to a lesser extent BPFDoor targeting network-edge appliances, involve products at the perimeter of networks. The pattern is consistent and has been for several years: attackers are not trying to get through your firewall. They are targeting the products that are your firewall, your gateway, your mail filter, your code repository.
These products are trusted. They sit in privileged network positions. They are often managed by third parties. And they are updated less frequently than endpoints because change management processes treat them as infrastructure rather than software. That mismatch between operational trust and patch cadence is the gap that today’s threat actors are systematically exploiting.
If there is one structural recommendation that emerges from today’s briefing, it is this: the patch review process for network-edge appliances needs to be at least as fast as the process for workstations. In most UK SMB environments, it is considerably slower. That needs to change.
If Threat Analysis is useful to you, follow the show wherever you listen so tomorrow’s briefing lands automatically, and if you know someone who should be across this, pass it on. These are not obscure edge cases. They are the vulnerabilities being exploited against real organisations right now.