CISA adds exploited GitLab RCE and Cisco firewall DoS to KEV
Original title: CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV
Federal civilian agencies are told to apply fixes for both flaws by November 1, 2026.
CISA added CVE-2026-97229 in GitLab Community and Enterprise Edition and CVE-2026-76418 in Cisco Secure Firewall ASA and Threat Defense software to the Known Exploited Vulnerabilities catalog, citing active exploitation. The GitLab flaw can let an unauthenticated user run code through a crafted regular expression in CI/CD configuration. The Cisco flaw can make an unauthenticated remote attacker reload the device and cause a denial of service. Alpine Linux said an unknown actor probed its unpatched GitLab on October 20 and 21 and later attempts were blocked.
Unconfirmed: Alpine cannot rule out that the GitLab exploit succeeded; Cisco has not identified attackers or scope.
- GitLab CVE-2026-97229 has a CVSS score of 10.0.
- Cisco CVE-2026-76418 has a CVSS score of 8.6.
- Alpine said crafted CI configurations crashed GitLab workers eight times.
- Alpine found no tampering of aports, packages, or the October 21 releases.
- Cisco has not named the attackers or how many organizations were targeted.
Impact: Unauthenticated GitLab code execution or Cisco firewall denial of service
| Product | Affected |
|---|---|
| GitLab Community Edition and Enterprise Edition | — |
| Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software | — |
- 1.FCEB agencies should apply the fixes by November 1, 2026.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76418 | Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth | 8.6 | <1% | KEV | KEV |
| CVE-2026-97229 | Unauthenticated RCE in GitLab CE/EE via CI/CD regex | 10.0 | 18% | KEVPoC ×5 | KEV |
From the original article
2 min read at thehackernews.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.