CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV

CISA has added two security flaws affecting Cisco and GitLab software to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. The additions cover a GitLab remote code execution issue and a Cisco firewall denial-of-service issue, with Federal Civilian Executive Branch agencies recommended to apply fixes by November 1, 2026.

KEV additions and severity

CVE-2026-97229 has a CVSS score of 10.0 and affects GitLab Community Edition and Enterprise Edition. It is an integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration due to insufficient regular expression validation. CVE-2026-76418 has a CVSS score of 8.6 and affects Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software. It is an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial-of-service condition.

Exploitation reports

Cisco said it became aware of active exploitation of the firewall flaw earlier this month. It has not publicly identified the attackers, the number of targeted organizations, or the actions taken by attackers after gaining initial access. The GitLab addition relates to a security incident disclosed by Alpine Linux in which an unknown threat actor unsuccessfully attempted to exploit the flaw targeting its instance on October 20 and 21, 2026.

Alpine Linux incident details

Specifically, the attacker probed an unpatched GitLab instance by sending crafted CI configurations, causing the GitLab worker processes to crash eight times. In four of those crashes, the exploit failed at the next step. The threat actor also downloaded Alpine Linux's GitLab container image. Subsequent attempts by the attacker to get back in on October 25 and 26 were blocked.

"The attack came close to working," the maintainers of the security-focused Linux distribution said. "We have found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch. Our checks show that the aports repository, packages, and the October 21 releases were not tampered with."

Recommended action

In light of active exploitation, Federal Civilian Executive Branch agencies are recommended to apply the fixes by November 1, 2026.

Earlier coverage: Alpine Linux rebuilds GitLab after attempted CVE-2026-97229 exploit · Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls · GitLab patches CVSS 10.0 flaw allowing unauthenticated remote code execution

Sources: The Hacker News