Actively Exploited GitLab and Cisco Firewall Flaws Land on the CISA Known Exploited List
The U.S. Cybersecurity and Infrastructure Security Agency has added two vulnerabilities to its Known Exploited Vulnerabilities catalog, one affecting GitLab and one affecting Cisco firewall software. The first, CVE-2026-97229, carries a CVSS score of 10.0 and affects both GitLab Community Edition and Enterprise Edition. It is an integer overflow or wraparound issue that, under certain conditions, could allow an unauthenticated user to execute arbitrary code on the GitLab server. Affected builds are GitLab 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. The second, CVE-2026-76418, scores 8.6 and affects Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, where an unchecked return value leads to a NULL pointer dereference that an unauthenticated remote attacker can use to force a device reload and cause a denial of service.
On the GitLab side, the root cause is insufficient validation of regular expressions supplied in CI/CD configurations. A specially crafted regular expression placed in a pipeline configuration can trigger the integer overflow and, under the right conditions, lead to code execution on the GitLab server itself without the attacker holding an account. The flaw was reported privately through the vendor's HackerOne bug bounty programme by the researcher joaxcar, and the vendor has shipped fixed builds in the 19.2, 19.3 and 19.4 branches. For the Cisco issue, the vendor has not published a detailed exploitation chain; what is documented is that a remote, unauthenticated attacker can reach the vulnerable code path and cause the affected ASA or FTD device to reload, and that Cisco became aware of active exploitation earlier this month. Cisco has not disclosed who is behind those attacks, how many organisations were targeted, or what the attackers did afterwards.
Both flaws sit on systems that organisations rarely place behind other defences. A GitLab instance is the point where source code, build secrets, deployment credentials and signing material converge, so unauthenticated code execution on that host is effectively a foothold in the software build pipeline rather than a single compromised web application. A perimeter firewall running ASA or FTD is the opposite problem: it is unlikely to leak data in this case, but a remotely triggerable reload means an attacker can knock the gateway offline repeatedly and disrupt the VPN and inspection services that depend on it. Exploitation status is confirmed for both: CVE-2026-97229 and CVE-2026-76418 were added to the CISA KEV catalog on 29 October 2026, which means in-the-wild use is established and not merely suspected. FIRST EPSS currently puts the probability of exploitation activity in the next 30 days at 27.3 percent for CVE-2026-97229 and 0.8 percent for CVE-2026-76418, so the GitLab flaw is the one drawing the most attacker interest by a wide margin. Alpine Linux reported that an unknown attacker attempted to exploit the GitLab vulnerability against its infrastructure on 20 and 21 October 2026 and that the attempts failed. Under Binding Operational Directive 22-01, U.S. federal civilian agencies have a remediation deadline of 1 November 2026 for both entries, an unusually short window that reflects how current the exploitation is. Private organisations are outside the scope of that directive, but the same exposure applies to any internet-reachable GitLab instance or ASA and FTD appliance in the affected version ranges, and a compressed federal deadline is a reasonable proxy for how quickly the rest of the market is expected to be targeted.
Attack Surface
Web Application, Infrastructure, Remote Access Service
Tactics
Initial Access, Execution, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1059 – Command and Scripting Interpreter
- T1499 – Endpoint Denial of Service
- T1499.004 – Application or System Exploitation
SuperPRO's Threat Countermeasures Procedures
- Upgrade GitLab Community Edition and Enterprise Edition to 19.2.8, 19.3.5 or 19.4.2 or later, which contain the vendor fix for the CVE-2026-97229 regular expression validation flaw; instances on 19.2, 19.3 or 19.4 below those builds remain exploitable without authentication.
- Apply the fixed Cisco Secure Firewall ASA Software and Cisco Secure FTD Software release identified in the Cisco advisory for CVE-2026-76418; treat internet-facing ASA and FTD appliances as the first remediation wave since the reload can be triggered by an unauthenticated remote attacker.
- Meet the CISA Binding Operational Directive 22-01 deadline of 1 November 2026 for both CVE-2026-97229 and CVE-2026-76418 if you are a U.S. federal civilian agency, and use the same date as an internal target for commercial estates with exposed GitLab or ASA and FTD devices.
- Remove the GitLab web interface and API from unrestricted internet exposure where patching cannot be completed immediately, restricting access to corporate VPN ranges or an approved administrative IP allow list, since CVE-2026-97229 requires no account to exploit.
- Alert on unexpected ASA or FTD device reloads and crash dump generation on affected firewalls, and correlate reload events with unauthenticated inbound traffic to the device, as a forced reload is the observable outcome of CVE-2026-76418 exploitation.
- Review GitLab pipeline and application logs for .gitlab-ci.yml submissions containing unusually long or malformed regular expressions, and for pipeline jobs created by unauthenticated or unexpected sources around and after 20 October 2026, the date of the reported attempt against Alpine Linux.
- Rotate CI/CD secrets, deploy keys, runner registration tokens and personal access tokens stored on any GitLab instance that ran an unpatched 19.2, 19.3 or 19.4 build while reachable from the internet, and review runner job history for unauthorised builds.
