CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV Catalog

Overview of CISA's Latest KEV Additions

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited security vulnerabilities affecting GitLab and Cisco software to its Known Exploited Vulnerabilities (KEV) catalog. The inclusion follows reports and evidence indicating that both flaws are being targeted in real-world attacks.

Organizations utilizing the affected software are urged to review the technical details and apply vendor-supplied patches promptly to mitigate potential risks.

Detailed Breakdown of the Vulnerabilities

The two vulnerabilities added to the KEV catalog include:

• CVE-2026-97229 (CVSS Score: 10.0): An integer overflow or wraparound vulnerability impacting GitLab Community Edition (CE) and Enterprise Edition (EE). Caused by insufficient regular expression validation, this flaw allows an unauthenticated user to execute arbitrary code on the target GitLab server using a specially crafted regular expression inside a CI/CD configuration.
• CVE-2026-76418 (CVSS Score: 8.6): A NULL pointer dereference vulnerability stemming from an unchecked return value in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. This allows an unauthenticated, remote attacker to trigger an unexpected device reload, leading to a denial-of-service (DoS) condition.

Real-World Incidents and Threat Activity

Reports indicate active targeting for both vulnerabilities:

• Alpine Linux Incident: Alpine Linux disclosed a security incident where an unknown threat actor attempted to exploit CVE-2026-97229 against its GitLab instance on October 20 and 21, 2026. The attacker sent crafted CI configurations that crashed worker processes, downloaded a container image, and made subsequent blocked attempts on October 25 and 26. Maintainers noted that while they found no definitive evidence of successful compromise, they treated the instance as compromised, rebuilt it from scratch, and verified that package repositories remained untampered.
• Cisco Disclosures: Cisco reported awareness of active exploitation regarding CVE-2026-76418 earlier in the month. Public reports do not currently identify the threat actors, the specific scale of targeted organizations, or precise post-exploitation actions.

Practical Implications and Mitigation

Following CISA's guidance, Federal Civilian Executive Branch (FCEB) agencies have been given a remediation deadline of November 1, 2026, to apply the necessary patches. Private sector organizations and other entities utilizing Cisco Secure Firewall or self-hosted GitLab instances should also review their systems for unauthorized access and apply official updates immediately.

To verify the original announcements and technical updates, administrators should consult the official CISA KEV catalog, Cisco's security advisories, and GitLab's security release documentation.