On Friday, October 23, 2026, the SEC’s Division of Examinations published its priorities for fiscal year 2027. The report covers more than 34,000 registrants, from investment advisers and broker-dealers to transfer agents and funding portals. Two changes stand out for finance and security leaders. The report now uses the term “super intelligence,” or SI, where earlier years said artificial intelligence. And examiners say they will check how firms prepare for SI-generated phishing and “synthetic or deepfake voice and video used for social engineering.”

The priorities do not create new rules. They tell registrants where examiners will look first. For a CFO or CISO at an adviser, a broker-dealer, or a vendor that sells to them, that makes the document a useful checklist to run before an examiner does.

What the report says

The SEC’s press release lists eight areas of focus. Among them are investment advisers’ fiduciary duties and conflicts, retail products that are complex or illiquid, private funds and private credit, broker-dealer financial responsibility and anti-money laundering compliance, and “operational resiliency, cybersecurity, and protection of customer information.” Another is “emerging technologies, including super intelligence.”

The cyber and technology language sits in section VII of the full report, “Risk Areas Impacting Various Market Participants.” Three parts matter most.

• Cybersecurity. Examiners will review “governance practices, data loss prevention, access controls, account management, and the response and recovery protocols for cyber-related incidents, including ransomware attacks.” They will also assess risk from “registrants’ increased use of third-party service providers and shared technologies.”
• Emerging financial technology. The report says threat actors are using SI “to automate and accelerate cyberattacks, making those attacks more efficient and harder to detect.” Examiners will check firms’ preparation for those attacks. They will also review policies for monitoring SI used in fraud detection, back-office work, AML and Regulation Best Interest compliance, and trading.
• Regulation S-P and Regulation S-ID. Under the amended Regulation S-P, staff will evaluate response programs for unauthorized access to customer information, “including customer notification procedures and oversight of service providers.” Under Regulation S-ID, examiners will focus on red flags for identity theft, “particularly during customer account takeovers and fraudulent transfers,” and on whether firms update their programs for risks “related to SI and stolen credentials.”

For firms covered by Regulation SCI, the report adds that examiners will review reliance on “cloud and other third-party vendors,” including how those firms identify vendor systems that count as SCI systems.

The leadership letter at the front of the report also says the Division is using SI in its own work, to support analysis and workflow “while supplementing, but not replacing, staff judgment.”

What changed in the wording

The shift from “AI” to “super intelligence” is a change of label, not of rule. The report says firms must keep complying with “existing, technology-neutral obligations.” What is new is how specific the threat language is. Deepfake voice and video are named. Account takeover and stolen credentials are named. Vendor oversight shows up in three places: the cybersecurity section, the S-P section and the SCI section.

That matches what security teams already see. A voice that sounds like the CFO is not proof the CFO approved a wire. Our guide, Stop using a voice as approval, covers the control that answers it.

What it means for CFOs/CISOs

If you work at an SEC registrant, assume an examiner will ask three questions. Can you show a written process for verifying payment and account-change requests that does not depend on recognizing a voice or face? Can you show who your service providers are, what customer data they hold, and how they would tell you about a breach? And can you list the SI tools in use across the firm and who reviews what they produce?

For a CFO, the payment-verification question is the one with direct money at stake. A callback rule to a number already on file, plus a second approver for changes to bank details, costs little and is easy to show. For a CISO, the vendor question is the bigger lift, because the answer lives in contracts, not in the security stack.

If you sell software or services to advisers or brokers, expect these questions to move into your security questionnaires over the coming months. Your customers will need evidence from you to answer their examiners.

What to do this week

1. Map the bullets to controls. Take the cybersecurity, SI and S-P/S-ID paragraphs from section VII and list, next to each, the policy or control that answers it and its owner. Gaps go on a risk exception register with an expiry date.
2. Write down payment verification. If the callback and second-approver rule is a habit rather than a written procedure, write it down this week.
3. Inventory SI tools and agents. List each tool, who owns it, what it can read and change, and who reviews its output. The AI agent inventory does this in a browser.
4. Check service-provider notice terms. For vendors that hold customer information, confirm the contract says how fast they must tell you about unauthorized access. Note the gaps for the next renewal.

Vendor gaps at renewal. Service-provider notice terms are easiest to fix at renewal. The Renewal Audit reviews up to 25 software renewals for a fixed $199 and returns a written report in 5 business days. If you would rather run it yourself, the Renewal & Risk Operator Pack ($29) has spreadsheet versions of the renewal scorecard and the risk exception register.

What to watch next

Watch for risk alerts from the Division of Examinations during the year; the report says priorities may shift with market events and new technology. Watch for the first examination deficiency letters that cite SI-related phishing or deepfake controls. And watch your inbound vendor questionnaires: if customers start asking about deepfake verification and SI monitoring, this report is why.

Sources

• SEC press release 2026-109, “SEC Announces Fiscal Year 2027 Examination Priorities,” October 23, 2026
• SEC Division of Examinations, “Examination Priorities: Fiscal Year 2027” (PDF), section VII, “Risk Areas Impacting Various Market Participants,” and the message from the leadership team

Related: The SEC clock starts at material and Security and vulnerabilities.

On Tuesday, October 27, 2026, CISA added two bugs to its Known Exploited Vulnerabilities catalog: an unrestricted file upload flaw in Adobe Commerce and Magento Open Source, CVE-2026-48356, and an unchecked return value in Google’s Brotli compression library, CVE-2026-111497. Both carry a federal due date of November 10, 2026. Four days earlier, on October 23, CISA listed a SQL injection bug in on-premises Arista VeloCloud Orchestrator, CVE-2026-114625, with a due date of October 26, three days after listing.

The three entries have one thing in common for a finance or security leader: in each case the fix is probably not in your own hands. A storefront is often run by an agency or host. Brotli ships inside other products. A VeloCloud Orchestrator is often managed by a network provider. The work this week is to find out who owns each patch and to get a dated answer from them.

What happened

• July 14, 2026: Adobe published bulletin APSB26-73 for Adobe Commerce, Adobe Commerce B2B and Magento Open Source. It fixes 14 CVEs. CVE-2026-48356 is the highest rated, listed by Adobe as critical, CVSS 3.1 base score 9.6, with no authentication required. NVD’s record, published the same day, scores it 9.3 and notes that a victim must visit a crafted URL or interact with a compromised page. At publication Adobe said it was “not aware of any exploits in the wild.” The bulletin was last updated August 11.
• October 21: Google’s Brotli project released version 1.2.1. The release notes list one security item: CVE-2026-111497, an “out-of-bounds write” that “permits remote code execution.”
• October 22: NVD published the Brotli record. It says Brotli versions 1.0.3 through 1.2.0 are affected on all platforms, and that users should move to 1.0.10, 1.1.1 or 1.2.1. The same day Arista published Security Advisory 0199 for VeloCloud Orchestrator, rated CVSS 3.1 9.9, and said the issue “was detected by Arista and is known to be actively exploited.”
• October 23: CISA added the Arista bug to the catalog with forensic triage required, along with a Collabora Online bug that only affects the built-in CODE server app for Nextcloud (CVE-2026-110447).
• October 27: CISA added the Adobe and Brotli bugs in catalog version 2026.10.27. For both, the catalog lists known ransomware use as “Unknown” and forensic triage as not required.

Adobe Commerce and Magento: CVE-2026-48356

CISA describes the flaw as an unrestricted upload of a file with a dangerous type “that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim’s account or session.” Adobe’s bulletin lists the affected releases as Adobe Commerce 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and earlier; Adobe Commerce B2B 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 and earlier; and Magento Open Source 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 and earlier. The fixed builds carry a “2026-jul” suffix, such as 2.4.8-2026-jul.

The gap matters. The patch has been out since July. A store that applied it is in a different position from one that has not been touched since spring. Adobe’s “not aware of any exploits” line was written in July, and CISA now says the bug is being used.

Google Brotli: CVE-2026-111497

Brotli is a compression format used on the web and inside many applications. CISA’s entry says a crafted Brotli-compressed stream can let a remote, unauthenticated attacker “corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code.” The catalog flags it as affecting “an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products.”

You cannot patch Brotli by itself in most cases. It sits inside web servers, browsers, language runtimes, appliances and SaaS back ends. The fix arrives when each of those vendors ships an updated build. The question for a vendor is narrow: does your product include Brotli 1.0.3 through 1.2.0, and when will it move to a fixed release?

Arista VeloCloud Orchestrator: CVE-2026-114625

VeloCloud Orchestrator is the management console for VeloCloud SD-WAN, formerly sold by Broadcom. Arista’s advisory says that on an affected on-premises system “any authenticated user can gain operator privileges” and act as a local superuser operator. The lowest built-in tenant role, Enterprise Read Only, is enough. Arista says hosted and dedicated versions were already patched.

Affected releases are 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10 and 6.4.x before 6.4.2.12. Arista says end-of-support versions have not been assessed. It lists two source IP addresses seen in the attacks, 74.82.197.86 and 38.54.50.151, and asks operators to preserve web, application, system and database logs before fixing a system they suspect was compromised. The federal due date passed on October 26.

What it means for CFOs/CISOs

For a CFO, each of these bugs is a contract question first. If an agency runs the storefront, does the agreement say who applies security patches, and how fast? If a managed network provider runs the orchestrator, does the contract give you the right to ask for a patch date and logs? If the answer is “nobody wrote that down,” the cost of finding out arrives during an incident, when it is highest.

For a CISO, the Brotli entry is the harder one. It is a supply-chain item. Your inventory will not list Brotli unless you hold software bills of materials for the products you run. The Magento and VeloCloud entries are simpler: either you run the product or you do not, and the version number answers the rest.

The federal due dates bind federal civilian agencies under BOD 26-04, not private companies. They are still a fair benchmark for a board or an insurer asking how quickly you responded.

What to do this week

1. Storefront. If you sell online on Adobe Commerce or Magento, ask whoever runs it, in writing, for the installed version and whether it is a 2026-jul build or later. Ask them to check for unexpected uploaded files. Record the answer and the date.
2. Brotli. Send key vendors a one-line question: “Does your product ship Brotli 1.0.3 through 1.2.0, and when will you ship 1.0.10, 1.1.1, 1.2.1 or later?” Log answers, and any open item, in a risk exception register with an owner and an expiry. The SBOM request pack builds the longer version of the ask.
3. SD-WAN. Confirm whether your VeloCloud Orchestrator is on premises or hosted. If it is on premises, check the version against the fixed releases, restrict the web interface to administrative networks, and search logs for the two IP addresses Arista published.
4. Contracts. At the next renewal of any agency, host or managed network contract, add a patch timeline and a log-access clause. The software renewal scorecard has a place to note it.

Contract terms at renewal. The patch-timeline and log-access questions above are easiest to win at renewal. The Renewal Audit reviews up to 25 software renewals for a fixed $199 and returns a written report in 5 business days. If you would rather run it yourself, the Renewal & Risk Operator Pack ($29) has spreadsheet versions of the renewal scorecard and the risk exception register.

What to watch next

Watch for vendor advisories that name Brotli. They usually trail the upstream fix by days or weeks, and they are what tells you whether a specific product is exposed. Watch whether Adobe updates APSB26-73 to reflect exploitation. Watch NVD for an analysis of the Brotli and Arista records. And watch the KEV catalog itself: CISA can change the ransomware field from “Unknown” to “Known” after listing.

Sources

• CISA Known Exploited Vulnerabilities catalog and JSON feed, version 2026.10.27, checked October 27, 2026 (entries for CVE-2026-48356, CVE-2026-111497, CVE-2026-114625 and CVE-2026-110447: date added, due date, ransomware use, forensic triage)
• Adobe, “Security update available for Adobe Commerce, APSB26-73,” published July 14, 2026, last updated August 11, 2026
• Google Brotli release v1.2.1, October 21, 2026
• Arista Security Advisory 0199, October 22, 2026
• NVD entries CVE-2026-48356, CVE-2026-111497 and CVE-2026-114625
• CISA BOD 26-04, Prioritizing Security Updates Based on Risk

Related: PHP2Shell was probed before the patch, the same vendor-inventory logic for PHP, and Security and vulnerabilities, every security briefing, guide and tool in one place.

On Friday, October 30, 2026, CISA added two more Ivanti Connect Secure bugs to its Known Exploited Vulnerabilities catalog: CVE-2026-111357, a missing authentication flaw that allows privilege escalation, and CVE-2026-118527, a predictable identifier flaw that lets an authenticated attacker upload files to a known location on disk. The federal due date for the first is November 2, three days after listing. The day before, CISA listed a GitLab remote code execution bug, CVE-2026-97229, and a Cisco firewall VPN denial-of-service bug, CVE-2026-76418, both due November 1.

Three exploited bugs with deadlines inside three days is unusual. Two of them sit on remote-access VPN appliances, the front door for staff working off site. The third sits on a self-managed code server that often holds deployment credentials. If your organization runs any of the three, this is weekend work, not next-sprint work.

What happened

• October 12, 2026: GitLab released critical patch versions 19.4.2, 19.3.5 and 19.2.8 for Community and Enterprise Edition. The top fix, CVE-2026-97229, is rated CVSS 10.0. GitLab said GitLab.com was already patched and Dedicated tenants were patched before release.
• October 13: CISA added Ivanti Connect Secure CVE-2026-104935, an authentication bypass that allows a remote, unauthenticated attacker to run arbitrary commands, with a due date of October 16.
• October 23: The Ruby project released Ruby 4.0.9, 3.4.12 and 3.3.13, which fix the regular expression engine bugs behind the GitLab issue and three related GitLab CVEs.
• October 28: Cisco published an advisory for the ASA and FTD SSL VPN bug, rated High with a CVSS base score of 8.6, and said it was aware of active exploitation in October.
• October 29: CISA added the GitLab and Cisco bugs, both due November 1.
• October 30: CISA added the two new Ivanti bugs in catalog version 2026.10.30 and updated its Ivanti alert to cover all three Connect Secure CVEs and a revised list of affected versions.

For all four, the catalog lists known ransomware use as “Unknown.”

Ivanti Connect Secure: a chain, not a single bug

CISA’s catalog entries say each of the two new Ivanti bugs “can be chained with” CVE-2026-104935 and the other. CISA’s alert, last revised October 30, says threat actors are exploiting the three together, which “allows remote, unauthenticated execution of arbitrary commands,” to steal credentials and exfiltrate data. Affected versions are Connect Secure 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior. CISA tells organizations to update to the latest version as set out in Ivanti’s security advisory for CVE-2026-104935, and points to Ivanti’s 25.x upgrade and migration compatibility guide.

Two details in the alert matter more than the patch itself. First, CISA says Ivanti’s Integrity Checker Tool “may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory.” Organizations that want to know whether they were compromised “will need to conduct network and memory forensics.” A clean result from the vendor’s checker is not proof of a clean appliance.

Second, if you suspect compromise, CISA recommends Ivanti’s recovery procedure:

1. Back up the appliance configuration.
2. Factory reset the appliance and upgrade it to the latest version. For cloud and virtual systems, rebuild the instance and upgrade.
3. Restore the configuration from the backup.
4. Reset passwords for all accounts, including domain, administrator and local accounts. Revoke and reissue stored certificates. Reset stored API keys and license server credentials.

CISA also says Connect Secure 22.8 reaches end of life on January 31, 2027, and recommends Volexity’s write-up, “A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days.” We could not load Ivanti’s own advisory page when checking this piece, so the version and recovery details above are as CISA states them.

GitLab CVE-2026-97229: really a Ruby bug

GitLab’s advisory says the flaw “could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration.” Affected versions are 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. Only self-managed installs are exposed. GitLab published six threat detections for self-managed customers, with names such as “Onigmo native worker crash” and “ci lint workhorse worker crash.”

The root cause is in Onigmo, the regular expression engine inside Ruby. The Ruby project’s October 23 post says GitLab compiles user-supplied patterns with Regexp.new, and that crafted patterns “could corrupt memory while Ruby compiles them.” GitLab assigned four CVEs to related bugs: CVE-2026-89078 and CVE-2026-93577 (fixed in GitLab 19.4.1), CVE-2026-97229 (19.4.2) and CVE-2026-110264 (19.5.1). Patching for this one CVE is not enough if you are still below 19.5.1.

CISA’s catalog note goes further: “Other products can potentially be affected by the same underlying Ruby/Onigmo Integer Overflow issue.” Ruby says the bugs are reached only when an application compiles a regular expression from attacker-controlled input, through Regexp.new, Regexp.union, Regexp.compile or interpolation into a literal. Ruby also says Regexp.timeout does not protect against them, and neither does limiting pattern length. Ruby 4.0.9, 3.4.12 and 3.3.13 contain all the fixes.

Cisco ASA and FTD: VPN outage risk

Cisco’s advisory describes a bug in the Remote Access SSL VPN service of Secure Firewall ASA and Secure Firewall Threat Defense software. An unauthenticated, remote attacker can send a crafted request while connecting and force the device to reload. Cisco says “a successful VPN login is not required to reach the affected processing path.”

The exposure is narrower than the headline suggests. A device is affected only if it runs a vulnerable release, the SSL VPN login is reachable, and secondary authentication is configured at tunnel-group scope, including on the default group, DefaultWEBVPNGroup. Cisco says there are no workarounds, but there is a mitigation: remove secondary authentication, or disable the tunnel group list if the default group does not use it. Both lower your security posture or change how users log in. First fixed releases include ASA 9.18.4.96, 9.20.4.50, 9.22.3.200 and FTD 7.2.13, 7.4.9 and 7.6.7; the full table is in the advisory.

What it means for CFOs and CISOs

For a CISO, the Ivanti entries change the question from “are we patched?” to “were we compromised before we patched?” An appliance that was internet-facing and unpatched after October 13 should be treated as a possible breach, and the recovery steps above are a project: an appliance rebuild, a reset of every account the device touched, and reissued certificates.

For a CFO, that project has a cost, in staff time or in an outside forensics bill, and it can land on short notice. The 22.8 end-of-life date of January 31, 2027 is a second cost. If you run 22.8, a migration to 25.x is coming whether or not you were hit, and it belongs in the budget and the renewal tracker now. The GitLab and Ruby item is a supply-chain question: which of your vendors ship Ruby applications that accept user-written patterns?

The federal due dates bind federal civilian agencies under BOD 26-04, not private companies. They are still a fair benchmark for a board or an insurer asking how quickly you responded.

What to do this week

1. Ivanti. List every Connect Secure instance and its version. Upgrade per Ivanti’s advisory. If an instance was exposed and unpatched after October 13, run the CISA recovery steps and do not rely on the Integrity Checker Tool alone.
2. GitLab. Upgrade self-managed GitLab to a fixed release, and to 19.5.1 or later to cover CVE-2026-110264. Check logs against GitLab’s six published detections.
3. Ruby. Ask your developers and key vendors whether any Ruby application compiles user-supplied patterns, and whether it runs Ruby 4.0.9, 3.4.12, 3.3.13 or later. Log open answers in a risk exception register with an owner and an expiry.
4. Cisco. Check whether any tunnel group, including DefaultWEBVPNGroup, uses secondary authentication. If it does, upgrade, or apply the mitigation as a stopgap.
5. Calendar. Put January 31, 2027 for Connect Secure 22.8 in the software renewal scorecard.

End-of-life dates at renewal. A forced migration is easiest to price before the contract renews. The Renewal Audit reviews up to 25 software renewals for a fixed $199 and returns a written report in 5 business days. If you would rather run it yourself, the Renewal & Risk Operator Pack ($29) has spreadsheet versions of the renewal scorecard and the risk exception register. To get KEV additions like these in a weekly digest, the free Grok Bot prompt pack includes a report-only CISA KEV digest routine.

What to watch next

Watch whether CISA or Ivanti publish further indicators for the Connect Secure chain, and whether the ransomware field changes from “Unknown” to “Known.” Watch for vendors outside GitLab naming the Ruby regex fixes in their own advisories. Watch whether Ruby requests its own CVE identifiers; its post says it has not, for now. And watch the November 13 due date for CVE-2026-118527, the last of this group.

Sources

• CISA Known Exploited Vulnerabilities catalog and JSON feed, version 2026.10.30, checked October 31, 2026 (entries for CVE-2026-111357, CVE-2026-118527, CVE-2026-104935, CVE-2026-97229 and CVE-2026-76418: date added, due date, ransomware use, forensic triage)
• CISA, “CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure,” October 13, 2026, last revised October 30, 2026
• Ivanti, Security Advisory Ivanti Connect Secure (CVE-2026-104935)
• GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8, October 12, 2026
• Ruby, “Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264,” October 23, 2026
• Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75, October 28, 2026
• NVD entries CVE-2026-111357, CVE-2026-118527, CVE-2026-97229 and CVE-2026-76418
• CISA BOD 26-04, Prioritizing Security Updates Based on Risk

Related: CISA added Magento and a compression library, the previous catalog roundup, and Security and vulnerabilities, every security briefing, guide and tool in one place.