GitLab CVSS 10.0 Flaw and Cisco Firewall Bug Listed as Exploited by CISA
CISA added a GitLab code-execution flaw and a Cisco firewall crash flaw to its exploited-vulnerability catalogue on 29 October 2026, with 1 November set for federal civilian agencies.
The US Cybersecurity and Infrastructure Security Agency (CISA) added two flaws on 29 October 2026 to its Known Exploited Vulnerabilities (KEV) catalogue. CISA describes the catalogue as its authoritative source of vulnerabilities exploited in the wild. One listed flaw is a GitLab remote code execution flaw. The other is a Cisco Secure Firewall denial-of-service flaw. The Hacker News reported the listing on 30 October.
GitLab's flaw, CVE-2026-97229, is rated CVSS 10.0 and lets an unauthenticated user run code on the server. The Cisco flaw, CVE-2026-76418, is rated CVSS 8.6. As of 30 October 2026, CISA recommends that federal civilian agencies apply the fixes by 1 November.
Two Products, Two Kinds of Exposure
The GitLab flaw sits in GitLab Community and Enterprise Editions. An attacker can use a crafted regular expression in a CI/CD configuration to run code on the server, and no login is needed. The Hacker News article attributes the flaw to insufficient regular expression validation and classes it as an integer overflow or wraparound issue. Wiz's vulnerability database places the bug in the CI/CD configuration compiler and dates its disclosure to 13 October 2026.
Wiz's entry lists the affected versions as 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. The fixed releases are 19.2.8, 19.3.5 and 19.4.2. According to the same entry, GitLab patched GitLab.com directly.
The Cisco flaw affects Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software. An unchecked return value leads to a null pointer dereference, which lets an unauthenticated remote attacker reload the device. Cisco's advisory says the flaw applies when a vulnerable release has its SSL remote access VPN login service reachable and secondary authentication configured on a tunnel group. Cisco states that Cloud-delivered Firewall, cdFMC, Secure Access and Secure FMC Software are not affected.
Cisco says it became aware of active exploitation of the flaw earlier in October. It has not publicly identified the attackers, the number of targeted organisations or any actions taken after access.
How the Alpine Linux Probes Unfolded
Between 20 and 21 October 2026, an unknown actor probed an unpatched GitLab instance run by Alpine Linux, sending crafted CI configurations. The probes crashed GitLab worker processes eight times. In four of those crashes, the exploit failed at its next step.
The attacker also downloaded Alpine's GitLab container image. Later attempts on 25 and 26 October were blocked.
Alpine's maintainers said "The attack came close to working," and found no evidence that the attack succeeded. They could not rule it out, so they treated the instance as compromised and rebuilt it from scratch.
Their checks showed that the aports repository, packages and the 21 October releases had not been tampered with.
What Operators of These Products Should Check
Readers in India who run self-hosted GitLab or Cisco ASA and FTD firewalls should compare installed versions with the vendors' advisories. Cisco's advisory maps each release train to a fixed build. For example, the ASA 9.18 train moves to 9.18.4.96, and the FTD 7.4 train moves to 7.4.9. Cisco recommends upgrading to a fixed release.
CISA's entries for both flaws list 1 November 2026 as the due date. Both entries refer to BOD 26-04 and CISA's forensic triage requirements. The Cisco entry says that if mitigations are unavailable, use of the product should be discontinued or the applicable cloud-service guidance followed. CISA's recommended date of 1 November 2026 is set for Federal Civilian Executive Branch (FCEB) agencies.
Administrators running GitLab can review their worker crash records for 20 to 26 October, the period covered by the Alpine Linux account.
Cisco says it became aware of active exploitation of the flaw earlier in October.
What Is Not Yet Known as of 30 October 2026
The attackers behind the GitLab probes have not been identified. Cisco has not named the actors behind the firewall exploitation.
As of disclosure, Wiz's entry says there is no confirmed public proof-of-concept for the GitLab flaw, though its metadata marks a public exploit as present. The same entry says the flaw has not yet been added to the KEV catalogue, based on available data. CISA's catalogue lists it, with a date added of 29 October 2026.
