GitLab CVSS 10 RCE and Cisco Firewall DoS Land on CISA's Exploited-Vulnerabilities List

Two more vulnerabilities joined CISA's Known Exploited Vulnerabilities (KEV) catalog this week, and both deserve immediate attention: a maximum-severity remote code execution flaw in GitLab and a denial-of-service bug in Cisco's Secure Firewall line. US federal civilian agencies have until 1 November 2026 to apply the fixes. Everyone else should treat that date as a sensible deadline too.

What was added

• CVE-2026-97229 (CVSS 10.0) – GitLab CE/EE. An integer overflow (wraparound) in the way GitLab validates regular expressions inside CI/CD configuration. An unauthenticated attacker can submit a crafted pipeline definition and execute arbitrary code on the GitLab server itself.
• CVE-2026-76418 (CVSS 8.6) – Cisco Secure Firewall ASA and FTD. An unchecked return value leads to a NULL pointer dereference. A remote, unauthenticated attacker can force the appliance to reload unexpectedly, taking the firewall offline.

Cisco has acknowledged that the firewall bug was already being exploited earlier in October. Details on who is behind the activity, how many organisations were targeted and what the attackers did after gaining access have not been made public.

The GitLab bug has already been tried in the wild

The GitLab entry is tied to an incident at Alpine Linux. On 20 and 21 October an unidentified actor went after the distribution's self-hosted GitLab instance, which had not yet been patched. The attacker submitted crafted CI configurations that crashed GitLab worker processes eight times; in four of those attempts the exploit chain broke down at the following step. The same actor also pulled Alpine's GitLab container image. Further attempts to get back in on 25 and 26 October were blocked.

Alpine's maintainers concluded that the attack came close to succeeding. They found no evidence of a successful compromise but could not rule one out, so they treated the server as compromised and rebuilt it from scratch. Their integrity checks showed that the aports repository, the package tree and the releases shipped on 21 October had not been altered.

Why it matters

• GitLab is a software supply-chain chokepoint. A pre-authentication RCE on a GitLab server exposes source code, CI secrets, signing keys and build pipelines in a single step. Even a failed attempt, as Alpine's experience shows, forces a costly rebuild and a full integrity review.
• Firewalls are perimeter targets. Repeated reloads of an ASA/FTD appliance cut connectivity and VPN access, and can serve as a distraction or a first step for other activity.
• A KEV listing means confirmed exploitation, not theoretical risk. Vulnerabilities with evidence of active exploitation should jump to the front of the patch queue.

What to do

1. Update GitLab CE/EE to the fixed releases GitLab has published. If you cannot patch immediately, restrict who can push CI configuration and review logs for unusual worker crashes around 20–26 October.
2. Update Cisco ASA and FTD and watch for unexpected appliance reloads.
3. Treat self-hosted GitLab as a crown-jewel asset: no direct internet exposure unless it is truly needed, MFA for every user, audit logs retained, and CI secrets rotated after any suspicious activity.
4. Check your exposure. Inventory the GitLab instances and Cisco firewalls reachable from the internet and confirm the versions they run.

Externally exposed GitLab servers and firewall management interfaces are exactly the kind of problem our vulnerability scanning service is built to find: unpatched versions of products on the KEV list, flagged before the remediation deadline starts to matter.