GitLab RCE and Cisco firewall DoS under active attack
A GitLab RCE, short for remote code execution, and a Cisco firewall denial-of-service flaw have been added to the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog. CISA added the two vulnerabilities on Thursday after finding evidence of active exploitation. The agency recommended that Federal Civilian Executive Branch agencies apply the available fixes by November 1, 2026.
The GitLab vulnerability, CVE-2026-97229, affects GitLab Community Edition and Enterprise Edition and has a Common Vulnerability Scoring System (CVSS) score of 10.0 on the 10-point severity scale. It is an integer overflow or wraparound flaw, which occurs when a calculation exceeds the range the software can correctly handle. An unauthenticated user, meaning someone who has not signed in, could send a specially constructed regular expression through a continuous integration and continuous delivery (CI/CD) configuration. CI/CD is the automated process used to build, test and release software.
GitLab does not sufficiently validate that regular expression, according to the vulnerability description. Exploitation could allow arbitrary code to run on the GitLab server without requiring an account. This makes the issue particularly important for organisations that operate their own GitLab installations, because the affected platform may contain source code and support automated software release processes.
The KEV entry for CVE-2026-97229 is connected to an incident disclosed by Alpine Linux. An unidentified threat actor targeted an unpatched GitLab instance belonging to the security-focused Linux distribution on October 20 and 21, 2026. The attempt involved sending crafted CI configurations to the instance. GitLab worker processes crashed eight times, and in four of those crashes the attempted exploit failed during its next stage.
The threat actor also downloaded Alpine Linux's GitLab container image. Further attempts to regain access on October 25 and 26 were blocked. Alpine Linux said it found no evidence that the exploit ultimately worked, but it could not exclude that possibility. The maintainers therefore handled the instance as though it had been compromised and rebuilt it from the beginning.
Alpine Linux's checks found no tampering with its aports repository, packages or releases dated October 21. The incident nevertheless illustrates an important distinction for website owners and IT teams: a failed or incomplete attack does not necessarily prove that a vulnerable system remained untouched. When evidence cannot settle whether access was obtained, rebuilding a system can remove uncertainty that would remain if operators relied only on visible signs of damage.
The second vulnerability, CVE-2026-76418, affects Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. It has a CVSS score of 8.6. The problem involves an unchecked return value that can lead to a null pointer dereference, a software failure caused when a program tries to use a memory reference that points to nothing valid.
An unauthenticated remote attacker could exploit the Cisco flaw to make an affected device reload unexpectedly. That interruption creates a denial-of-service (DoS) condition, meaning the device becomes temporarily unavailable and cannot provide its normal service. For a business relying on the affected equipment, an unexpected reload can disrupt network availability even though this vulnerability is not described as allowing arbitrary code execution.
Cisco said earlier in the month that it had become aware of active exploitation. The company has not publicly identified the attackers, disclosed how many organisations were targeted or described what the attackers did after obtaining initial access. Those unknowns limit what can be concluded about the scope and objectives of the activity, but the exploitation evidence is sufficient for CISA to include the flaw in KEV.
Administrators responsible for GitLab Community Edition, GitLab Enterprise Edition, Cisco ASA Software or Cisco FTD Software should verify that the relevant fixes have been applied rather than assuming perimeter controls or a lack of visible disruption means the systems are safe. GitLab operators should also treat unexplained worker crashes during CI configuration processing as a reason to investigate, while Cisco customers should examine unexplained device reloads and service interruptions. For organisations that need assistance managing this type of exposure, AEU-I offers security-first IT, infrastructure and consulting.
The two cases have different immediate effects: CVE-2026-97229 can lead to code execution on a GitLab server, while CVE-2026-76418 can force a security device to restart and interrupt service. Both can be reached remotely without authentication, both have evidence of exploitation, and CISA's November 1, 2026 deadline makes applying the available fixes the immediate priority.