CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV

CISA added CVE-2026-97229 and CVE-2026-76418 to its Known Exploited Vulnerabilities catalog after finding evidence of active exploitation. Both flaws affect products used to run or protect networked systems, making prompt patching important.

CVE-2026-97229 affects GitLab Community Edition and Enterprise Edition. It is an integer overflow or wraparound flaw involving regular-expression validation in CI/CD configurations. CVE-2026-76418 affects Cisco Secure Firewall ASA Software and Secure Firewall Threat Defense Software. It is an unchecked return value that can lead to a NULL pointer dereference.

The GitLab flaw could let an unauthenticated user execute arbitrary code on a GitLab server. The Cisco flaw could let an unauthenticated remote attacker cause a firewall device to reload unexpectedly, creating a denial-of-service condition. FCEB agencies were urged to apply fixes by November 1, 2026.

CISA’s Known Exploited Vulnerabilities, or KEV, catalog is a tracked list of security flaws with evidence that attackers are actively exploiting them. It helps organizations prioritize vulnerabilities that present an immediate, demonstrated threat rather than treating every disclosed flaw equally.

A listing matters because exploitation has moved beyond a laboratory possibility. In this case, CISA cited active exploitation involving both Cisco and GitLab software. Cisco said it became aware of exploitation earlier in the month, while Alpine Linux reported an attempted attack against its GitLab instance.

The risk is especially urgent for systems exposed to unauthenticated remote access. Attackers may not need an account before attempting exploitation. Federal Civilian Executive Branch agencies were recommended to apply the relevant fixes by November 1, 2026, showing the catalog’s practical effect on patching priorities.

The two vulnerabilities produce very different outcomes. CVE-2026-97229 could allow an unauthenticated user to execute arbitrary code on a GitLab server. That means the attacker could cause the server to run commands or instructions of the attacker’s choosing.

The GitLab attack begins with a specially crafted regular expression in a CI/CD configuration. The article attributes the weakness to insufficient regular-expression validation and identifies the underlying issue as an integer overflow or wraparound. No account is required. Cisco’s CVE-2026-76418 also requires no authentication.

For Cisco ASA and FTD software, the reported result is different. An attacker could trigger a NULL pointer dereference, causing the device to reload unexpectedly. The reload creates a denial-of-service condition because the firewall cannot continue normal operation while it is unavailable.

CVE-2026-97229 has a CVSS score of 10.0, while CVE-2026-76418 has a score of 8.6. CVSS is a standardized system for rating vulnerability severity on a scale from 0.0 to 10.0. Higher scores generally indicate greater potential danger.

The scores summarize factors such as whether an attacker needs authentication, how difficult exploitation is, and what impact successful exploitation can have. The GitLab flaw combines unauthenticated access with potential arbitrary code execution, which explains its maximum score. The Cisco flaw also requires no authentication but is described as causing denial of service.

A CVSS score does not count affected organizations, successful attacks, or the number of attackers. It is a severity measure. CISA’s decision to list both flaws adds a separate warning: evidence indicates they are being exploited, so their practical risk is immediate as well as theoretical.

An unknown threat actor targeted Alpine Linux’s unpatched GitLab instance on October 20 and 21, 2026. The attacker sent crafted CI configurations, causing GitLab worker processes to crash eight times. The activity was an attempted exploitation of CVE-2026-97229.

In four crashes, the exploit failed at the next step. The attacker also downloaded Alpine Linux’s GitLab container image. Further attempts to regain access on October 25 and 26 were blocked. These details show repeated probing but do not establish successful, lasting control.

Alpine Linux maintainers said they found no evidence that the exploit succeeded, while acknowledging they could not rule it out. They treated the instance as compromised and rebuilt it from scratch. Their checks found no tampering in the aports repository, packages, or October 21 releases. The evidence therefore points to an unsuccessful attack, not certainty that no access occurred.

GitLab CI/CD configurations are project instructions that define automated jobs, such as building and testing software. Regular expressions are patterns used to match or validate text. Worker processes are background components that perform those automated tasks or handle related GitLab work.

The article says CVE-2026-97229 is an integer overflow or wraparound vulnerability caused by insufficient regular-expression validation. An attacker can submit a specially crafted regular expression inside a CI/CD configuration. The malformed input can disrupt how numerical values are handled and cause worker processes to crash.

The reported impact is more serious than a simple crash. The flaw could allow an unauthenticated user to execute arbitrary code on the GitLab server. Alpine Linux observed eight worker-process crashes during probing, but said the exploit failed at the next step in four cases and found no evidence of successful compromise. The exact code-execution chain is not described.

Cisco ASA and FTD are firewall software platforms designed to protect networks by controlling and inspecting traffic between network areas. They help enforce security rules and maintain connectivity. If either platform becomes unavailable, protected services may lose an important network-control point.

CVE-2026-76418 involves an unchecked return value that leads to a NULL pointer dereference. In general, a NULL pointer means software is trying to use an invalid memory reference. If the error is not checked, the process or device may fail instead of handling the problem safely.

The article says an unauthenticated remote attacker can exploit the flaw to make the Cisco device reload unexpectedly. During that reload, the firewall cannot operate normally, producing a denial-of-service condition. Cisco said it learned of active exploitation earlier in the month, but did not identify the attackers, targeted organizations, or what they did after initial access.