CISA has flagged an exploited GitLab RCE flaw and a Cisco firewall denial-of-service bug, adding both to the Known Exploited Vulnerabilities catalog. The Hacker News reported that Federal Civilian Executive Branch agencies are recommended to apply fixes for CVE-2026-97229, a CVSS 10.0 unauthenticated GitLab bug, and CVE-2026-76418, a CVSS 8.6 Cisco ASA and FTD reload flaw, by November 1, 2026. Alpine Linux rebuilt its GitLab instance after an October attack it could not prove succeeded.
Key Takeaways
- CISA added GitLab RCE CVE-2026-97229 and Cisco ASA/FTD DoS to the KEV catalog.
- FCEB agencies are recommended to apply both fixes by November 1, 2026.
- Alpine Linux rebuilt GitLab from scratch after an October 20-21 exploit attempt.
- Cisco DoS needs no successful login; more than 51,000 ASA SSL VPN devices are exposed.
How the Exploited GitLab RCE Works
BleepingComputer reported that a researcher using the handle joaxcar found an integer overflow in the CI/CD Regular Expression Compiler, which parses, compiles, and evaluates regular expressions in pipeline configuration files. SecurityWeek reported that the failed validation sits in Onigmo, Ruby’s regular expression engine.
GitLab’s October 12 advisory said the bug “could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration.” Fixes are in versions 19.4.2, 19.3.5, and 19.2.8. After detecting exploitation attempts, GitLab released threat detections for self-managed customers.
Alpine Linux Rebuilt After the October Attempt
SecurityWeek reported a failed exploit against Alpine Linux on October 20 and 21, one week after disclosure. A newly registered account sent crafted CI configurations and crashed the worker process. SecurityWeek, citing Alpine, said that in four of those crashes the attacker got partway through the exploit and failed at the next step.
The Hacker News reported eight crashes and that the exploit failed at the next step in four. The attacker also downloaded Alpine’s GitLab container image. Alpine’s maintainers said the attack came close to working, The Hacker News reported.
We have found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch. Our checks show that the aports repository, packages, and the October 21 releases were not tampered with.
Attempts to get back in on October 25 and 26 were blocked. Alpine reset all passwords and warned of automated login attempts using passwords compromised in other leaks. It is still testing the instance before public release.
Alpine’s update to GitLab 19.3.6 did not patch the bug, because the image runs standard Ruby. Builds that supply their own Ruby also need 3.3.13, 3.4.12, 4.0.9, or later.
Cisco Firewall DoS Needs No Successful Login
BleepingComputer reported that Cisco PSIRT became aware of active exploitation of CVE-2026-76418 in October 2026. The Hacker News describes an unchecked return value that becomes a NULL pointer dereference in ASA and FTD. Cisco said the flaw is due to logic errors when secondary authentication is configured on a tunnel group.
A crafted request while connecting to the SSL remote access VPN can reload the device. “A successful VPN login is not required to reach the affected processing path,” Cisco noted, SecurityWeek reported.
An attack requires an unpatched release, a reachable SSL VPN login, the webvpn keyword with SSL VPN enabled on at least one interface, and secondary authentication on an affected tunnel group. Cisco’s cloud-delivered firewall and management offerings, Secure Access, and Secure Firewall Management Center are not vulnerable.
Cisco has not named attackers, targeted organizations, or post-access actions, and it has not published indicators of compromise. This is the second ASA and FTD denial-of-service zero-day since August’s CVE-2026-20349. SecurityWeek said it is unclear whether the same actor exploited both, and that no workarounds are available.
November 1 Recommendation and What to Patch
The Hacker News reported that CISA on Thursday added both flaws to the KEV catalog, and that FCEB agencies are recommended to apply both fixes by November 1, 2026. Binding Operational Directive 26-04 is tied in the sources only to the GitLab flaw: BleepingComputer said CISA ordered federal agencies to secure those servers by Sunday under that directive, and SecurityWeek described a three-day window under the same order.
The directive binds federal agencies only, but CISA encouraged private-sector teams to prioritize the GitLab flaw. Shadowserver, cited by BleepingComputer, tracks nearly 2,800 internet-exposed GitLab Community Edition instances and more than 51,000 Cisco ASA SSL VPN devices. It did not say how many are patched or which Cisco devices are honeypots.
| CVE | Software | CVSS | Impact | Internet exposure |
|---|---|---|---|---|
| CVE-2026-97229 | GitLab CE and EE | 10.0 | Unauthenticated remote code execution | Nearly 2,800 CE instances |
| CVE-2026-76418 | Cisco ASA and FTD | 8.6 | Unexpected device reload | More than 51,000 ASA SSL VPN devices |
Priority actions for IT teams:
- Patch GitLab CE and EE to 19.4.2, 19.3.5, or 19.2.8, and apply the threat detections GitLab released for self-managed instances.
- If you supply your own Ruby, also install 3.3.13, 3.4.12, 4.0.9, or later.
- Upgrade ASA and FTD to a fixed release. If patching waits, disable secondary authentication on DefaultWEBVPNGroup or on any user-configured tunnel-group list, turn off the tunnel-group list, or remove secondary authentication. Cisco warned that removing secondary authentication makes remote-access VPN less secure.
- Treat worker crashes and unexpected reloads as possible exploitation, not only capacity problems.
BleepingComputer reported that GitLab’s DevSecOps platform is used by over 50% of Fortune 100 companies and has more than 70 million registered users. Ranking these bugs by CVSS alone misses the Ruby packaging gap and the secondary-authentication condition that decides whether the firewall flaw is reachable. Teams already working through other CISA KEV additions, including the Arista VeloCloud vulnerability, should treat both as priority rather than wait for the next maintenance window.
