CISA Flags Actively Exploited GitLab RCE and Cisco Firewall DoS Bugs
Two very different vulnerabilities landed on CISA's Known Exploited Vulnerabilities (KEV) catalog on 29 October 2026: a maximum-severity remote code execution bug in GitLab and a crash-inducing flaw in Cisco's Secure Firewall line. Both are being used in the wild, and US federal civilian agencies have been told to patch by 1 November 2026. That is an unusually short deadline, and it tells you how seriously the agency rates the risk.
What was added
CVE-2026-97229 — GitLab CE/EE (CVSS 10.0). An integer overflow in the way GitLab validates regular expressions inside CI/CD configuration. Because the check is insufficient, an unauthenticated attacker can supply a specially crafted regex in a pipeline definition and run arbitrary code on the GitLab server itself. No account, no token, no prior access required.
CVE-2026-76418 — Cisco Secure Firewall ASA and FTD (CVSS 8.6). An unchecked return value leads to a NULL pointer dereference. A remote, unauthenticated attacker can trigger it to make the appliance reload unexpectedly, taking the firewall offline. Cisco says it became aware of exploitation earlier in October but has not said who is behind it, how many organisations were hit, or what the attackers did once they had a foothold.
The GitLab near-miss at Alpine Linux
The GitLab entry is tied to an incident at Alpine Linux, the security-focused distribution that underpins a huge share of container images. On 20 and 21 October an unknown actor targeted the project's own GitLab instance with crafted CI configurations. The payloads crashed GitLab worker processes eight times; in four of those attempts the exploit chain got past the crash and only failed at the following step. The attacker also pulled Alpine's GitLab container image, presumably to study it. Return visits on 25 and 26 October were blocked.
The maintainers were candid: the attack came close to working. They found no evidence it succeeded but could not rule it out, so they treated the server as compromised and rebuilt it from scratch. Their checks indicate the aports source repository, published packages and the 21 October releases were not tampered with.
Why this matters
A self-hosted GitLab server is a crown jewel. It holds source code, CI secrets, deployment credentials and, very often, the keys to production. An unauthenticated RCE with a CVSS of 10 on that system is as bad as it gets for a software team, and the Alpine incident shows attackers are already pointing working exploit code at it. The next target may not get the same combination of logging, vigilance and luck.
The Cisco bug is "only" a denial of service, but the device in question is an edge firewall. Knocking it offline interrupts VPN access and traffic inspection, and repeated reloads can be used as cover or as a pressure tactic. Edge appliances have been a favourite entry point for state-aligned groups for several years, so any ASA or FTD flaw under active exploitation deserves prompt attention.
KEV listings are binding only for US federal agencies, but the catalog is one of the most reliable public signals of what attackers are actually using right now. Private organisations should treat a KEV addition as a "patch this week" trigger, not a backlog item.
What to do
- GitLab administrators: upgrade every self-managed CE and EE instance to the fixed release now. If you cannot patch immediately, restrict network access to the instance and review recent pipeline definitions for unexpected or malformed regex patterns.
- Assume compromise if you were exposed. Check GitLab worker logs for repeated crashes in October, audit new or modified CI/CD configurations, and rotate runner tokens, deploy keys and any secrets stored in CI variables if anything looks off.
- Cisco ASA and FTD operators: apply the fixed software release, watch for unexplained reloads in device logs, and make sure management interfaces are not reachable from the internet.
- Everyone: keep an inventory of internet-facing software and versions, and follow KEV updates so new entries map to assets you own within hours, not weeks.
Flaws like these are exactly what continuous vulnerability scanning is built to catch: an outdated GitLab build or an unpatched ASA shows up as a prioritised, version-matched finding before an attacker finds it for you. Our team runs these checks against clients' external estates on an ongoing basis, so a KEV addition becomes a ticket with an owner, not a surprise.