CISA adds exploited GitLab RCE and Cisco DoS flaws to KEV catalog

The U.S. Cybersecurity and Infrastructure Security Agency added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on Thursday, and federal civilian agencies should apply fixes by Nov. 1, 2026.

The first flaw, CVE-2026-97229, is an integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise Edition rated at CVSS 10.0. An unauthenticated user can execute arbitrary code on the GitLab server by sending a specially crafted regular expression in a CI/CD configuration, because GitLab insufficiently validates regular expressions. Both CISA reporting and independent vulnerability coverage identify the same flaw and severity score.

The exploit chain involves a malicious CI configuration file with a UTF-8 repository path on a public project branch and the CI lint endpoint. That path triggers an integer overflow in Ruby’s Onigmo engine during expression recompilation, allowing code execution as the git user.

The second flaw, CVE-2026-76418, is an unchecked return value flaw that leads to a NULL pointer dereference in Cisco Secure Firewall ASA and Threat Defense software, rated at CVSS 8.6. An unauthenticated, remote attacker can trigger an unexpected device reload, causing a denial-of-service condition. Cisco reported that it learned of active exploitation earlier this month but has not disclosed the attackers, the number of targeted organizations, or what the attackers did after initial access.

CISA added the GitLab flaw after Alpine Linux disclosed that an unidentified threat actor tried without success to exploit the vulnerability on its own instance on Oct. 20 and 21, 2026. The intruder sent crafted CI configurations to an unpatched GitLab instance, which made the GitLab worker processes crash eight times. Four of the eight crashes did not lead to a successful next step for the exploit.

The intruder obtained a copy of Alpine Linux’s GitLab container image. Later attempts to access the system again on Oct. 25 and 26 were stopped. Alpine Linux maintainers said they found no evidence the attack succeeded but could not rule it out, so they considered the instance compromised and rebuilt it from scratch. “The attack came close to working,” the maintainers said.

Alpine Linux said its checks found no tampering with the aports repository, its packages, or the releases from Oct. 21. The distribution checked its build infrastructure and release artifacts after the incident.

GitLab patched CVE-2026-97229 in versions 19.2.8, 19.3.5, and 19.4.2. Vulnerable self-managed installations run versions 19.2.0 through 19.2.7, 19.3.0 through 19.3.4, or 19.4.0 through 19.4.1. GitLab.com is already patched.

Censys estimates 25,766 internet-facing hosts and 79,224 web properties currently run vulnerable versions of GitLab. Censys says unpatched releases are running on 31 percent of the 82,454 GitLab hosts it detected. Germany, Russia, and the United States account for the largest concentrations, with 6,469, 4,173, and 2,927 hosts respectively. Censys assigns CVE-2026-97229 an EPSS score of 18.4 percent over a 30-day window.

These exposure estimates come from the Censys advisory for CVE-2026-97229.

Researchers published a public proof-of-concept repository for the flaw on GitHub on Oct. 13, 2026. Rapid7 made public technical information and working exploit code soon after GitLab issued the fix. Daily CyberSecurity reported on Oct. 14 that neither GitLab nor Censys had confirmed active exploitation of the GitLab flaw in the wild and that it was not listed in the CISA KEV catalog.

If immediate patching is not possible, administrators should limit inbound access to the GitLab web interface and turn off untrusted public project creation. These are interim mitigation steps suggested for organizations unable to upgrade right away.

CISA maintains the Known Exploited Vulnerabilities catalog as the authoritative source of vulnerabilities exploited in the wild. Organizations should treat the KEV catalog as one input for their vulnerability management prioritization framework. The catalog is available in CSV, JSON, and Print View formats. CISA lists these download formats on the catalog page.

Federal civilian agencies should apply fixes for both flaws by Nov. 1, 2026. The deadline applies to the Federal Civilian Executive Branch, and CISA added the flaws based on evidence of active exploitation. The deadline is tied to active exploitation of the newly cataloged flaws.