The U.S. Cybersecurity and Infrastructure Security Agency has flagged two serious vulnerabilities—one in GitLab, another in Cisco firewall software—as actively exploited and added them to its Known Exploited Vulnerabilities (KEV) catalog. CISA’s move signals urgency: both flaws are being used in the wild, with confirmed attacks documented.
What Are the Flaws?
The first issue, CVE-2026-97229, rates a perfect 10.0 on the CVSS severity scale. It’s an integer overflow or wraparound bug in GitLab (both Community and Enterprise editions). The flaw allows unauthenticated attackers to inject malicious regular expressions into CI/CD configuration files, triggering remote code execution.
The second flaw, CVE-2026-76418, is a denial-of-service weakness found in Cisco Secure Firewall ASA and Threat Defense software. Thanks to an unchecked return value leading to a NULL pointer dereference, remote attackers can force affected devices to reload abruptly—without any credentials. The CVSS score here is 8.6.
Evidence of Active Attacks
Cisco disclosed that it had identified active exploitation of the firewall DoS flaw earlier in October 2026—but has not shared specifics on who is behind it or how many systems have been impacted.
In the case of the GitLab vulnerability, a security-focused Linux distribution based in Alpine detected exploit attempts around October 20–21, 2026. An attacker repeatedly sent malformed CI configurations, causing worker processes to crash multiple times. While some crashes halted further stages of the exploit, eight crashes were observed. Subsequent probe attempts were blocked, though the maintainers couldn’t entirely rule out successful compromise. They responded by rebuilding the instance from scratch.
Response and Recommendations
CISA is pushing for rapid mitigations. Federal Civilian Executive Branch agencies are required to apply patches or fixes by November 1, 2026. The GitLab flaw already has fixes available, and users of both GitLab editions should update immediately. Cisco users are also urged to patch or apply vendor-supplied fixes without delay.
This development shows how quickly attackers are finding and exploiting vulnerabilities—even those rooted in components as foundational as CI/CD pipelines and firewall software. For organizations, the lesson is clear: constant vigilance, rapid patching, and careful monitoring of dependencies are no longer best practices, but necessities.
