CISA adds exploited GitLab and Cisco firewall flaws to KEV
Original title: U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog
Federal agencies must fix unauthenticated GitLab code execution and a Cisco firewall reload bug by November 1, 2026.
CISA added CVE-2026-97229 in GitLab and CVE-2026-76418 in Cisco Secure Firewall software to its Known Exploited Vulnerabilities catalog. The GitLab integer-overflow flaw can let an unauthenticated user run arbitrary code through a crafted regular expression in CI/CD configuration. Cisco’s NULL-pointer bug can let an unauthenticated remote attacker reload ASA or FTD devices. Cisco says exploitation was active earlier this month, while reported attempts against Alpine Linux failed.
Unconfirmed: Cisco has not identified the attackers, the number of targets, or activity after access.
- CVE-2026-97229 has a CVSS score of 10.0; CVE-2026-76418 scores 8.6.
- GitLab 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are affected.
- Fixed GitLab releases are 19.2.8, 19.3.5, and 19.4.2.
- Alpine Linux saw failed exploit attempts on October 20 and 21, 2026.
- joaxcar reported the GitLab flaw through HackerOne.
Impact: Unauthenticated GitLab code execution; remote Cisco firewall denial of service
| Product | Affected | Fixed in |
|---|---|---|
| GitLab Community Edition and Enterprise Edition | 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 | 19.2.8, 19.3.5, and 19.4.2 |
| Cisco Secure Firewall ASA Software and Secure FTD Software | — | — |
- 1.Upgrade affected GitLab CE and EE installations to the patched releases.
- 2.Remediate both KEV entries by November 1, 2026, if a federal agency.
- Products
- GitLab Community EditionGitLab Enterprise EditionCisco Secure Firewall ASACisco Secure Firewall FTD
- Victims
- Alpine Linux
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76418 | Unauthenticated DoS in Cisco ASA and FTD SSL VPN with secondary auth | 8.6 | <1% | KEV | KEV |
| CVE-2026-97229 | Unauthenticated RCE in GitLab CE/EE via CI/CD regex | 10.0 | 18% | KEVPoC ×5 | KEV |
From the original article
2 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.