CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV

The agency cited evidence of active exploitation for both flaws. CVE-2026-97229 is a critical integer overflow vulnerability in GitLab that could allow an unauthenticated user to execute arbitrary code via a specially crafted regular expression in a CI/CD configuration. CVE-2026-76418 is a pointer dereference vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that could cause a device to reload, resulting in a denial-of-service (DoS) condition.

Cisco confirmed awareness of active exploitation of the firewall flaw earlier this month but has not publicly identified the attackers or the number of targeted organizations.

The GitLab vulnerability was recently targeted by an unknown threat actor against Alpine Linux's instance. The attacker probed an unpatched GitLab instance by sending crafted CI configurations, causing the GitLab worker processes to crash eight times. In four of those crashes, the exploit failed at the next step.

The attacker also downloaded Alpine Linux's GitLab container image. Subsequent attempts by the attacker to get back in on October 25 and 26 were blocked. The maintainers have found no evidence that the exploit succeeded but cannot rule it out, so they treated the instance as compromised and rebuilt it from scratch. Their checks show that the aports repository, packages, and the October 21 releases were not tampered with.

In light of the active exploitation, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the fixes by November 1, 2026.