This week’s security overview highlights actively exploited vulnerabilities affecting Cisco firewalls, a critical security flaw in Sophos UTM, and expanded detection coverage for PHP2Shell. The OPENVAS (ENTERPRISE) now includes dedicated checks for these threats, helping security teams identify potentially vulnerable systems across network devices and infrastructure platforms.
However, identifying an affected software version does not always establish whether a system is exposed. For Cisco and Sophos, exploitability depends on specific configuration settings. Vulnerability scan results therefore require additional verification before remediation priorities can be determined.
Cisco SSL VPN Vulnerability Under Active Exploitation
CVE-2026-76418 is a vulnerability affecting Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) devices. It allows an unauthenticated remote attacker to force an affected device to reload through its remote access SSL VPN service, causing a denial-of-service condition. Cisco has confirmed active exploitation and assigned the vulnerability a severity rating of 8.6 under CVSS v3.1. On 29 October, CISA included CVE-2026-76418 in its Known Exploited Vulnerabilities (KEV) catalog. France’s CERT-FR has also reported exploitation of the flaw.
Greenbone released two separate vulnerability checks on the same day. The Cisco ASA check uses remote banner detection, while the Cisco FTD check relies on package-level information.
Exploitation requires two conditions: an accessible SSL VPN service and secondary authentication enabled for the affected tunnel group. Cisco’s security advisory highlights two important technical details. First, the default tunnel group, DefaultWEBVPNGroup, is also subject to the vulnerability. Second, an attacker can reach the affected functionality without successfully authenticating to the VPN. These conditions make configuration verification an essential part of the assessment. Devices with the relevant SSL VPN and secondary authentication settings should be prioritized for remediation and compared against Cisco’s published fixed releases. Both Greenbone OPENVAS checks identify software versions associated with the vulnerability. If the affected SSL VPN configuration or secondary authentication is not present, the checks recommend creating an override for the corresponding finding.
The first software versions containing the security fix are:
- ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, and 9.24.1.27 або 9.24.10.1.
- FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1.
Cisco emphasizes that no workaround fully resolves the vulnerability. Removing secondary authentication from affected tunnel groups can temporarily reduce exposure, but this measure does not replace the security update. Upgrading to a fixed software release remains Cisco’s recommended remediation approach.
Sophos UTM: Critical Vulnerability Requires Manual Remediation
A newly published Greenbone vulnerability check provides detection for CVE-2026-118633, a critical security vulnerability affecting Sophos UTM. The remote banner check was introduced on 30 October. According to the Sophos security advisory, the vulnerability creates a potential path for unauthenticated attackers to execute commands with root privileges. Exploitation is possible when the email proxy is enabled with scanning functionality active and an attacker successfully exploits a race condition.
The underlying issue involves a path traversal vulnerability. All Sophos UTM versions are affected, although the relevant email proxy configuration is required for exploitation.
An additional complication is the product’s end-of-life status. Sophos UTM no longer receives updates through the standard supported-product lifecycle, and the vendor requires administrators to install the available security patch manually. The installation procedure is documented in Sophos knowledge base article KBA-000049692. Alternatively, organizations can migrate from Sophos UTM to a supported version of Sophos Firewall. The new Greenbone check helps identify systems that require closer examination. However, determining whether a deployment is actually exposed requires verification of its email proxy settings and installed security patches. After the hotfix has been successfully installed, the check recommends creating an override for the corresponding scan result.
PHP2Shell: Expanded Detection Across Enterprise Infrastructure
Greenbone has previously published detailed guidance on detecting and scanning for PHP2Shell vulnerabilities.
Since that publication, the threat landscape has evolved. On 26 October, CISA added both CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog. The OPENVAS ENTERPRISE FEED has also received additional product-specific checks for these vulnerabilities. Recent updates extend detection to several enterprise infrastructure platforms, including:
- Juniper Junos OS (JSA112681): Separate remote banner checks for Junos OS and Junos OS on SRX Series devices.
- NetApp ONTAP 9 (NTAP-20261021-0021): A dedicated remote banner vulnerability check.
- Aruba ClearPass Policy Manager (HPESBNW05171): Detection through a package-level check.
- Check Point Gaia (sk1000302): A product-specific remote banner check.
Remediation options differ depending on the affected platform. For Juniper Junos OS deployments outside the SRX Series, no security fix was available as of 27 October. SRX Series devices have a different remediation path. Starting with Junos OS 25.2R1, PHP is no longer included in the operating system. These developments demonstrate why PHP2Shell assessments should extend beyond standalone PHP installations. Enterprise appliances and vendor-managed platforms containing PHP components also require examination.
Turning Vulnerability Findings Into Remediation Actions
Effective vulnerability management requires more than identifying potentially affected software releases. Configuration settings, vendor advisories, and patch availability must also be considered when evaluating exposure and planning remediation. Maintaining an updated OPENVAS ENTERPRISE FEED and regularly scanning relevant infrastructure provides the foundation for these activities. The following actions address the Cisco, Sophos, and PHP2Shell vulnerabilities covered in this overview:
- Update the OPENVAS ENTERPRISE FEED. Perform a manual feed update to obtain the newly published vulnerability checks immediately.
- Scan the relevant infrastructure. Assess Cisco ASA and FTD devices, Sophos UTM installations, PHP environments, and enterprise products that incorporate affected PHP components. Particular attention should be given to systems associated with vulnerabilities listed in CISA’s KEV catalog.
- Validate configuration and remediation status. For Cisco and Sophos findings, compare the actual system settings against the documented exploitation requirements. Verify installed updates and apply the relevant vendor recommendations. If the required conditions are absent or an applicable hotfix has already been deployed, create an override for the scan result where appropriate.
The available checks identify potentially vulnerable software versions, installations, and packages. However, a detected vulnerability does not necessarily mean that the affected system is exploitable under its current configuration. Likewise, the presence of a vulnerability finding does not prove that the system has already been compromised or that exploitation has occurred.
