CISA adds exploited GitLab and Cisco flaws to KEV catalog

The U.S. Cybersecurity and Infrastructure Security Agency has added two actively exploited vulnerabilities affecting GitLab and Cisco products to its Known Exploited Vulnerabilities catalog. The entries are CVE-2026-97229, a CVSS 10.0 GitLab Community Edition and Enterprise Edition flaw that can lead to unauthenticated remote code execution, and CVE-2026-76418, a CVSS 8.6 denial-of-service issue in Cisco Secure Firewall ASA and FTD Software.

CISA cited evidence of active exploitation and recommended that Federal Civilian Executive Branch agencies apply the available fixes by November 1, 2026. The additions make both defects immediate patching priorities for organisations operating the affected software.

GitLab flaw is tied to attempted intrusion at Alpine Linux

CVE-2026-97229 is an integer overflow or wraparound vulnerability caused by insufficient validation of regular expressions. An unauthenticated user can send a specially crafted regular expression in a CI/CD configuration and execute arbitrary code on a GitLab server.

Alpine Linux disclosed that an unknown actor attempted to exploit the flaw against its GitLab instance on October 20 and 21. The attacker sent crafted CI configurations to an unpatched server, crashing GitLab worker processes eight times. In four cases, the exploit failed at its next stage, and the actor also downloaded Alpine Linux’s GitLab container image.

Attempts to regain access on October 25 and 26 were blocked. Alpine Linux said it found no evidence of a successful compromise, but could not rule one out and therefore rebuilt the instance from scratch. Its checks found that the aports repository, packages and October 21 releases had not been tampered with.

Cisco issue can force firewall reloads

CVE-2026-76418 stems from an unchecked return value that can result in a NULL pointer dereference in Cisco Secure Firewall ASA Software and Secure Firewall FTD Software. An unauthenticated remote attacker could cause an affected device to reload unexpectedly, creating a denial-of-service condition.

Cisco said earlier in October that it was aware of active exploitation, but it has not publicly identified the attackers, the number of targeted organisations or actions taken after initial access. The Cisco exposure sits alongside Cisco vulnerability chains and ClickFix attacks as a reminder that firewall vulnerabilities can quickly become operational incidents when exploitation is confirmed.

Operational response

Teams should establish whether GitLab CE or EE, Cisco ASA, or Cisco FTD deployments are within scope, apply vendor fixes on an urgent basis, and examine relevant logs for crafted CI configurations, worker crashes, unusual container-image downloads, and unexplained firewall reloads. Where compromise cannot be excluded, incident-response decisions should reflect the affected system’s role and exposure.

The practical business implication is clear: organisations should treat these KEV additions as an immediate asset, patching, and monitoring task, rather than waiting for public attribution or a confirmed breach in their own environment.