On October 29, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog — a critical remote code execution vulnerability in GitLab CE/EE (CVE-2026-97229, CVSS 10.0) and a DoS vulnerability in Cisco Secure Firewall (CVE-2026-76418, CVSS 8.6). Both vulnerabilities are being exploited in real-world attacks. Organizations using GitLab versions 19.2–19.4 or Cisco ASA/FTD with secondary authentication configured on tunnel groups must install updates immediately. For U.S. federal agencies, the remediation deadline is set to November 1, 2026.
CVE-2026-97229: unauthenticated remote code execution in GitLab
According to the CVE record, vulnerability CVE-2026-97229 belongs to the CWE-190 class (integer overflow) and has received the maximum CVSS score of 10.0 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. This means: a network attack vector, low attack complexity, no need for authentication or user interaction, and full impact on confidentiality, integrity, and availability, with effects that extend beyond the context of the vulnerable component.
The vulnerability allows an unauthenticated attacker to execute arbitrary code on a GitLab server by submitting a specially crafted regular expression in a CI/CD configuration. The root cause is insufficient validation of regular expressions, resulting in an integer overflow.
Affected versions of GitLab Community Edition and Enterprise Edition:
- 19.2 up to 19.2.8
- 19.3 up to 19.3.5
- 19.4 up to 19.4.2
We have previously provided a detailed analysis of this vulnerability. Its inclusion in the KEV catalog now confirms that the threat has moved from a theoretical to a practical one.
According to the source material, the reason for adding it to KEV was an incident reported by the Alpine Linux project. Available data indicates that an unknown attacker attempted to exploit the vulnerability against an unpatched GitLab instance on October 20 and 21, 2026, by submitting specially crafted CI/CD configurations. GitLab workflows crashed eight times, and in four instances the exploit failed at the next stage. The attacker also uploaded an Alpine Linux GitLab container image. Repeat access attempts on October 25 and 26 were blocked. The Alpine Linux maintainers stated that “the attack was close to succeeding,” but found no evidence of successful compromise. Nevertheless, the instance was treated as compromised and rebuilt from scratch. Checks showed that the aports repository, packages, and releases as of October 21 had not been modified. It should be noted that this information comes from a news source rather than directly from Alpine Linux, so the incident details should be treated with caution.
CVE-2026-76418: denial of service in Cisco Secure Firewall
The second vulnerability — CVE-2026-76418 — affects Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. According to the Cisco advisory, the vulnerability is classified as CWE-690 (unchecked return value leading to null pointer dereference) with a CVSS score of 8.6.
The issue is related to logical errors in request handling when secondary authentication is configured on a tunnel group in the Remote Access SSL VPN service. An unauthenticated remote attacker can trigger an unexpected device reboot, resulting in a denial of service. A critical point: according to Cisco, a successful VPN login is not required to reach the vulnerable code path. This significantly expands the attack surface — anyone able to send a request to the SSL VPN interface can potentially force the device to reboot.
Cisco PSIRT reports that active exploitation of this vulnerability was detected in October 2026. At the same time, neither the threat actors, nor the number of targeted organizations, nor the actions taken after initial access have been publicly identified.
Remediation prioritization
Although the Cisco vulnerability (8.6) has a lower CVSS score than the GitLab issue (10.0), remediating both problems requires equally high priority. In Cisco’s case, a combination of several factors makes the situation particularly dangerous: confirmed active exploitation, no need for authentication to reach the vulnerable code, and the absence of a full-fledged workaround. Cisco lists only one mitigation measure — disabling secondary authentication on affected tunnel groups or on the default group DefaultWEBVPNGroup. However, this may conflict with an organization’s security policies, so upgrading to a fixed software version remains the preferred option.
For organizations that have previously encountered vulnerabilities in Cisco products, it is worth noting that we have already covered critical vulnerabilities in Cisco ISE and Cisco SD-WAN Manager, which underscores the need for a systematic approach to vulnerability management in Cisco infrastructures.
Recommendations
For GitLab CE/EE:
- Update to versions 19.2.8, 19.3.5, or 19.4.2, respectively
- Review CI/CD logs for anomalous configurations with non-standard regular expressions
- Restrict network access to GitLab instances until the update is complete
For Cisco ASA/FTD:
- Install the software update to a fixed version as specified in the Cisco advisory
- If immediate updating is not possible, consider disabling secondary authentication on affected tunnel groups as a temporary measure
- Check whether secondary authentication is configured on custom or default tunnel groups (DefaultWEBVPNGroup)
- Monitor devices for unexpected reboots, which may indicate exploitation attempts
Both vulnerabilities are being actively exploited, and the window for safe updating is shrinking. Organizations using the affected products should treat patch deployment as a matter of hours rather than days — especially for Cisco ASA/FTD, where the lack of a full workaround leaves updating as the only reliable means of protection.
