CISA flags exploited GitLab and Cisco flaws

CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog on Thursday, both with evidence of active exploitation. One is a perfect-score GitLab flaw that lets an unauthenticated user run code on the server. The other reloads Cisco firewalls on demand.

CVE-2026-97229 carries a CVSS score of 10.0. It is an integer overflow in GitLab Community Edition and Enterprise Edition. GitLab’s regular expression validation is insufficient, so a specially crafted regex inside a CI/CD configuration can trigger the overflow and let an unauthenticated user execute arbitrary code on the GitLab server. CI/CD config is attacker-reachable because that is what it is for: anyone who can submit a pipeline definition through a path the server parses gets to feed the regex engine.

The exploitation evidence comes from Alpine Linux. On October 20 and 21, an unknown threat actor sent crafted CI configurations at Alpine’s unpatched GitLab instance. The worker processes crashed eight times. In four of those crashes the exploit failed at the next step, which says the attacker was getting partway through the chain and missing the landing. The actor also pulled down Alpine’s GitLab container image, presumably to study the target offline. Further attempts on October 25 and 26 were blocked.

The maintainers of the security-focused distribution said the attack “came close to working.” They found no evidence it succeeded but could not rule it out, so they treated the instance as compromised and rebuilt it from scratch. Their checks showed the aports repository, packages, and the October 21 releases were not tampered with. For a CVSS 10.0 RCE that crashed your workers eight times, rebuilding from scratch is the conservative and correct response.

The Cisco side is quieter but sits on a lot of edge hardware. CVE-2026-76418, CVSS 8.6, is a NULL pointer dereference from an unchecked return value in Secure Firewall ASA and Secure Firewall Threat Defense (FTD) software. An unauthenticated remote attacker can make the device reload unexpectedly, a denial of service. Cisco said it became aware of active exploitation earlier this month. It has not named the attackers, said how many organizations were hit, or described what the attackers did afterward.

ASA and FTD boxes terminate VPNs and guard the edge, so they are exactly the devices you cannot casually reboot during business hours. An attacker who can reload one on demand can hold a network’s remote access hostage or open a window during the reload.

CISA set the deadline for both fixes at November 1, 2026 for Federal Civilian Executive Branch agencies. That date has passed, so any FCEB instance still unpatched is late. Everyone else should read the deadline as a measure of urgency rather than a legal obligation.

Patch GitLab to the fixed release and Cisco ASA/FTD to Cisco’s patched software. If you cannot patch GitLab immediately, assume any instance that accepts CI/CD configs from untrusted or semi-trusted users is reachable, and watch for repeated worker process crashes, which is the signature Alpine saw. For the Cisco flaw the symptom is an unexpected device reload, and there is no post-exploitation cleanup to hunt for because the crash is the payoff.