CISA Adds Exploited GitLab and Cisco Firewall Flaws to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two vulnerabilities in Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence that attackers are actively exploiting them.

The vulnerabilities

CVE-2026-97229 (CVSS score: 10.0) is an integer overflow in GitLab Community Edition and Enterprise Edition. Because of insufficient regular expression validation, an unauthenticated user can execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration.

CVE-2026-76418 (CVSS score: 8.6) is a NULL pointer dereference caused by an unchecked return value in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. An unauthenticated remote attacker can make the device reload unexpectedly, causing a denial of service.

The Cisco attacks

CISA's move follows Cisco's statement that it became aware of active exploitation of the flaw earlier this month. Cisco has not publicly said who is behind the attacks, how many organizations were targeted, or what the attackers did after gaining initial access.

The Alpine Linux incident

The addition of CVE-2026-97229 relates to an incident disclosed by the Alpine Linux developers. An unknown threat actor tried, unsuccessfully, to exploit the flaw against the project's GitLab instance on October 20 and 21, 2026.

The attacker probed the unpatched server with crafted CI configurations, crashing GitLab worker processes eight times; in four of those crashes, the exploit failed at the next step. The attacker also downloaded the GitLab container image used by Alpine Linux. Later attempts to get back in on October 25 and 26 were blocked.

"The attack came close to working," the maintainers of the security-focused distribution said. "We have found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch. Our checks show that the aports repository, packages, and the October 21 releases were not tampered with."

Deadline

Given the active exploitation, U.S. Federal Civilian Executive Branch (FCEB) agencies are advised to apply the fixes by November 1, 2026.

Source: The Hacker News