IT & AI brief, 30 October 2026: Cisco ASA and GitLab exploited, Teams Graph channel default
CISA adds Cisco ASA/FTD, GitLab, VMware ESX and Linux kernel flaws to its exploited list, Teams Graph channels default to Threads in November, and Purview auto-labeling adds legacy Office files.
The most urgent items are on the CISA Known Exploited Vulnerabilities list: Cisco Secure Firewall ASA and FTD software and GitLab were added on 29 October with a very short remediation deadline. On the Microsoft side, new Teams channels created through Graph will default to the Threads layout from late November.
CISA KEV: Cisco ASA/FTD and GitLab added with a 1 November deadline
What changed: On 29 October CISA added CVE-2026-76418 (Cisco Secure Firewall ASA Software and Secure FTD Software) and CVE-2026-97229 (GitLab Community and Enterprise Edition) to the KEV catalog. Both carry a due date of 1 November 2026 for US federal agencies, which signals urgency for everyone else too.
Who is affected: Anyone running Cisco ASA or FTD firewalls, or self-managed GitLab servers. GitLab.com is hosted by the vendor.
What to do: Check the vendor advisories for the fixed versions, patch internet-facing firewalls and GitLab instances first, and review logs for unusual access. If you cannot patch immediately, restrict management access to trusted networks.
CISA KEV: VMware ESX and Linux kernel flaws
What changed: On 28 October CISA listed CVE-2026-41709 in Broadcom VMware ESX (due 11 November) and CVE-2026-46300 in the Linux kernel (due 31 October). Entries from 27 October also cover Google Brotli (CVE-2026-111497) and Adobe Commerce and Magento (CVE-2026-48356), both due 10 November. Details are in the KEV catalog.
Who is affected: Virtualisation hosts running ESX, Linux servers and appliances, and online shops on Adobe Commerce or Magento. Brotli is a compression library embedded in many products, so check vendor advice for software you rely on.
What to do: Add these CVEs to your patch tracker, match them against your asset inventory, and prioritise internet-facing systems. Apply the vendor's fixed builds and restart where required.
Teams: Graph-created channels will default to Threads
What changed: MC1530957 says the Microsoft Graph v1.0 Create channel API will default to the Threads layout instead of Posts when a request omits layoutType. Rollout starts in late November 2026 for Worldwide, GCC, GCC High and DoD. Existing channels are not changed, and requests that set a layout are unaffected. Note that the API value for Threads is chat, and Posts is post.
Who is affected: Teams with scripts, provisioning tools or third-party apps that create channels through Graph without specifying a layout.
What to do: Find that automation. If you want Posts, add "layoutType": "post" before the rollout. If Threads is fine, test your workflows and ask third-party vendors which layout they set. See also /blog/teams-private-vs-shared-channels.
Purview auto-labeling extends to legacy Office files
What changed: MC1530948 says service-side auto-labeling will evaluate and label .doc, .xls and .ppt files in SharePoint and OneDrive, in both simulation and enforcement modes. Public preview starts in early November and general availability in late November 2026.
Who is affected: Organisations using Purview auto-labeling policies on SharePoint and OneDrive. New policies include legacy formats automatically.
What to do: For existing policies, edit and save them (a small change such as a comment works) and rerun them so the crawl covers legacy files. Run them in simulation first and review results before enforcing. Background: /blog/purview-sensitivity-labels-deployment.
Teams: explicit consent for PSTN participants in one-to-one calls
What changed: MC1530950 extends the existing explicit recording consent setting to one-to-one calls with phone-network participants. When recording or transcription starts, the participant hears a prompt and presses 1 to consent or 2 to decline. Until they consent, their audio is excluded, and those who decline stay muted. General availability begins in early December 2026. No new setting is added, and it is off by default.
Who is affected: Organisations that require recording consent in Teams calling policies and take one-to-one calls with external phone users.
What to do: Review the calling policy setting for participant agreement, and update help desk guidance if you already enforce consent. See /blog/teams-meeting-policies-recording-lobby.
Copilot Chat will show which memories shaped a reply
What changed: MC1530959 adds a Personalization tab under Sources in Microsoft 365 Copilot Chat. It lists the custom instructions, saved memories and past chats used in a response, and users can open a saved memory to review or delete it. Rollout is worldwide and was due to finish in late October. It does not change what Copilot remembers.
Who is affected: Users with memory turned on and a Microsoft 365 Copilot licence.
What to do: No action needed. Admins who want to restrict memory can use the Enhanced Personalization control, scoped by Entra group.
Also worth knowing
Was this helpful?
Get the next guide
Free checklists and new guides: a short weekly digest on Sundays, or an email each day with new articles. Unsubscribe in one click.
Comments
Questions and tips are welcome. Comments are checked by the EpiFive team before they appear; please do not share passwords, phone numbers or other private details.