On Thursday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two security vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. The update targets critical flaws in software from GitLab and Cisco, prompting immediate attention from federal agencies.
The first vulnerability, identified as CVE-2026-97229, carries a maximum CVSS score of 10.0. It is an integer overflow or wraparound issue found in both GitLab Community Edition and Enterprise Edition. This flaw allows unauthenticated users to execute arbitrary code on the server by submitting a specially crafted regular expression within a CI/CD configuration, exploiting insufficient validation mechanisms.
The second entry, CVE-2026-76418, has a CVSS score of 8.6 and affects Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. This vulnerability stems from an unchecked return value leading to a NULL pointer dereference. It enables unauthenticated remote attackers to force the device to reload unexpectedly, resulting in a denial-of-service condition.
Cisco previously disclosed awareness of active exploitation for its firewall vulnerability earlier this month but has not publicly identified the attackers, the number of targeted organizations, or specific actions taken by threat actors after gaining initial access.
Regarding the GitLab flaw, CISA's addition follows a security incident reported by Alpine Linux. An unknown threat actor attempted to exploit the vulnerability against an Alpine Linux instance on October 20 and 21, 2026. The attacker probed an unpatched GitLab instance by sending crafted CI configurations, which caused the GitLab worker processes to crash eight times. In four of these instances, the exploitation attempt failed at a subsequent step.
The threat actor also downloaded Alpine Linux's GitLab container image. Further attempts to re-enter the system on October 25 and 26 were successfully blocked. While maintainers of the security-focused Linux distribution stated that the attack came close to working, they found no definitive evidence of success. However, unable to rule out a compromise, they treated the instance as breached and rebuilt it from scratch. Subsequent checks confirmed that the aports repository, packages, and October 21 releases remained untampered.
In light of these active exploitation campaigns, Federal Civilian Executive Branch (FCEB) agencies are advised to apply the necessary fixes by November 1, 2026.
Sources: The Hacker News.