CISA Adds GitLab RCE and Cisco Firewall DoS Vulnerabilities to KEV Catalog

CISA has officially added two actively exploited vulnerabilities affecting GitLab and Cisco infrastructure to its Known Exploited Vulnerabilities catalog. SMBs running vulnerable instances face immediate risk and must apply vendor mitigations immediately or risk system compromise and unexpected reloads.

Timeline and Attack Details

The recent security developments involve two distinct CVEs that have drawn immediate attention from federal authorities and threat intelligence teams. On October 13, 2026, the GitLab vulnerability was published as CVE-2026-97229, carrying a maximum CVSS score of 10.0. Shortly after, on October 28, 2026, Cisco published CVE-2026-76418 with an 8.6 CVSS score. CISA subsequently added both vulnerabilities to its KEV catalog on October 29, 2026, mandating that federal agencies apply fixes by November 1, 2026.

Evidence of active exploitation highlights the severity of these flaws. Alpine Linux disclosed a security incident where an unknown threat actor unsuccessfully probed an unpatched GitLab instance on October 20 and 21, 2026. The attacker sent crafted CI configurations that crashed GitLab worker processes multiple times, and even downloaded the Alpine Linux GitLab container image. Although subsequent attempts on October 25 and 26 were blocked and maintainers found no evidence of tampering, the instance was treated as compromised and rebuilt entirely. Meanwhile, Cisco reported active exploitation of its firewall vulnerability earlier this month, though specific targeting data remains undisclosed.

The affected versions span specific software configurations across both vendors:

Who Is Affected and How to Check

Organizations utilizing self-hosted GitLab Community Edition or Enterprise Edition within the specified version ranges are directly exposed to unauthenticated remote code execution via malicious CI/CD configurations. Because the flaw stems from insufficient regular expression validation leading to an integer overflow or wraparound, attackers can target exposed servers without credentials. Similarly, organizations utilizing Cisco Secure Firewall ASA or FTD software with secondary authentication configured on a remote access SSL VPN tunnel group are vulnerable to denial of service attacks.

To verify your exposure, perform an immediate asset inventory check against your deployment versions. Review your infrastructure management tools, container registries, and firewall management planes to identify exact build numbers. For external perimeter checks, consider utilizing our comprehensive security services or automated vulnerability assessments to map your external exposure.

The specific assets requiring immediate verification include:

Immediate Remediation Steps

Apply vendor-supplied patches and software updates immediately. For GitLab, upgrade to versions 19.2.8, 19.3.5, 19.4.2, or later depending on your deployment branch. For Cisco firewalls, apply the official software updates provided by Cisco to address the unchecked return value leading to NULL pointer dereference.

If immediate patching is operationally impossible, evaluate your internet exposure and disable vulnerable services such as external access to vulnerable SSL VPN endpoints or isolate self-hosted GitLab runners. Organizations should align their remediation priorities with CISA guidance and ensure continuous monitoring via a 24x7 security operations center to detect abnormal worker crashes or unexpected device reloads.

Key mitigation actions to execute right now are:

Indicator Analysis and Post-Exploitation Signs

Detecting exploitation requires looking for specific behavioral anomalies in your system logs. For GitLab, monitor worker process stability. As observed in the Alpine Linux incident, attackers probe servers by submitting crafted CI configurations that cause worker processes to crash repeatedly. If you notice unexplained process crashes alongside unauthorized container image downloads or unexpected file system modifications, treat the server as compromised.

For Cisco firewall deployments, monitor device stability for unexpected reloads caused by crafted SSL remote access VPN connection requests. Since unauthenticated attackers can trigger a denial of service condition via logic errors in secondary authentication routines, sudden reloads without administrative commands should be investigated immediately.

Signs of potential compromise or active probing include:

Implications for Small and Mid-Size Businesses

Small and mid-size businesses often underestimate their attractiveness to threat actors, assuming advanced exploits are reserved for enterprise targets or government agencies. However, automated scanners routinely probe the internet for unpatched KEV vulnerabilities like CVE-2026-97229 and CVE-2026-76418. A successful RCE attack on a GitLab server can grant an attacker full access to your source code repositories, internal deployment credentials, and proprietary software pipelines.

SMBs operating with lean IT teams must leverage managed security partners to maintain visibility over perimeter assets. Whether you operate in the US or India, ensuring rapid patch management and robust endpoint telemetry is vital. Partnering with specialists for managed IT services ensures that critical CVEs are addressed before opportunistic threat actors can weaponize them against your infrastructure.

Sources