CISA flags active exploits in GitLab and Cisco firewall flaws

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two high-severity vulnerabilities affecting GitLab and Cisco software to its Known Exploited Vulnerabilities (KEV) catalog. This update, released on Thursday, October 30, 2026, cites confirmed evidence that threat actors are actively exploiting these flaws in the wild.

What happened

The first vulnerability, tracked as CVE-2026-97229, carries a perfect CVSS score of 10.0. It affects both GitLab Community Edition and Enterprise Edition. The flaw allows an unauthenticated user to execute arbitrary code on the server by submitting a specially crafted regular expression within a CI/CD configuration. This issue stems from insufficient validation of regular expressions, leading to an integer overflow or wraparound error.

The second entry, CVE-2026-76418, impacts Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. With a CVSS score of 8.6, this vulnerability involves an unchecked return value that leads to a NULL pointer dereference. An unauthenticated, remote attacker can trigger this bug to cause the device to reload unexpectedly, resulting in a denial-of-service (DoS) condition. Cisco acknowledged earlier this month that it detected active exploitation of this flaw, though it has not identified the attackers or the scope of the campaign.

The inclusion of the GitLab flaw follows a public disclosure by Alpine Linux. The maintainers reported that an unknown threat actor attempted to exploit the vulnerability against their infrastructure on October 20 and 21, 2026. The attacker sent crafted CI configurations that caused GitLab worker processes to crash eight times. In four instances, the exploit failed at the subsequent step. The actor also downloaded the GitLab container image from the instance. Although later attempts on October 25 and 26 were blocked, Alpine Linux treated the instance as compromised and rebuilt it from scratch as a precaution.

How it works

The GitLab vulnerability exploits how the application handles regular expressions in CI/CD pipelines. Regular expressions are patterns used to match character combinations in strings. When validation is weak, a maliciously complex pattern can cause an integer overflow. This occurs when a calculation produces a number larger than the maximum size allowed for the data type, causing it to wrap around to a negative or small value. In this case, the overflow bypasses security checks, allowing code execution without authentication.

The Cisco flaw is a memory management error. When software fails to check if a function returned a valid value before using it, it may attempt to access a NULL pointer. A NULL pointer represents no valid memory address. Dereferencing it causes the program to crash or, in embedded systems like firewalls, trigger a reboot. Because this can be triggered remotely without credentials, it serves as an effective denial-of-service vector.

Key details

• CVE-2026-97229: Critical remote code execution in GitLab CE and EE via CI/CD regex overflow.
• CVE-2026-76418: High-severity DoS in Cisco ASA and FTD software via NULL pointer dereference.
• Active exploitation: Both flaws have confirmed active exploitation in the wild as of late October 2026.
• Alpine Linux incident: Attackers crashed GitLab workers eight times and downloaded container images but likely failed to gain full control.
• Federal deadline: Federal Civilian Executive Branch agencies must apply patches by November 1, 2026.
• Cisco status: Active exploitation confirmed, but attacker identity and post-exploitation actions remain unknown.

Why it matters

For DevOps and infrastructure teams, these additions to the KEV catalog signal immediate risk. The GitLab flaw is particularly dangerous because it requires no authentication. If your CI/CD pipelines accept external contributions or if your GitLab instance is internet-facing, attackers can target it directly. The fact that Alpine Linux saw multiple crash attempts suggests automated scanning and exploitation tools are already circulating.

The Cisco vulnerability highlights the fragility of perimeter defenses. Firewalls are meant to protect networks, but a simple memory handling error can take them offline. For organizations relying on Cisco ASA or FTD devices, this means potential network outages initiated by remote actors. Since CISA mandates rapid patching for federal agencies, private sector organizations should treat these deadlines as best-practice benchmarks to avoid similar exposure.

What you can do

• Patch GitLab instances immediately to address CVE-2026-97229, prioritizing internet-facing servers.
• Update Cisco ASA and FTD software to the latest version to mitigate CVE-2026-76418.
• Review CI/CD pipeline configurations to restrict who can submit or modify regular expressions.
• Monitor firewall logs for unusual traffic spikes or unexpected reboots that may indicate DoS attempts.
• Verify that backup and rebuild procedures are tested, as Alpine Linux had to reconstruct its instance from scratch.
• Check if your organization falls under federal guidelines requiring compliance by November 1, 2026.