CISA Adds Critical GitLab and Cisco Vulnerabilities to KEV Catalog
Federal agencies must address these active exploitation risks by November 1st, 2026.
1CISA Expands KEV Catalog
The Cybersecurity and Infrastructure Security Agency has officially added two major vulnerabilities to its Known Exploited Vulnerabilities catalog. These include critical flaws identified in GitLab and Cisco software products. Federal agencies are now under a strict mandate to remediate these specific security gaps to maintain their network integrity against active threats.
2Critical GitLab RCE Flaw
CVE-2026-97229, carrying a maximum CVSS score of 10.0, allows unauthenticated attackers to execute arbitrary code. This integer overflow vulnerability stems from weak regular expression validation within CI/CD configurations. It impacts GitLab Community and Enterprise editions across versions 19.2, 19.3, and 19.4, requiring immediate upgrades to the latest patched releases.
3Cisco Firewall DoS Risk
The second addition, CVE-2026-76418, affects Cisco Secure Firewall ASA and FTD software with a CVSS score of 8.6. This NULL pointer dereference vulnerability enables remote, unauthenticated attackers to force device reloads, resulting in denial-of-service conditions. Cisco confirmed active exploitation of this flaw occurred earlier this month, necessitating urgent infrastructure updates.
4Discovery and Reporting Timeline
The GitLab vulnerability was originally reported via the HackerOne bug bounty program by researcher joaxcar. Alpine Linux recently documented failed exploitation attempts against their systems on October 20 and 21, 2026. These real-world incidents highlight the immediate danger posed by these flaws to organizations running affected software versions globally.
5Mandatory Remediation Deadlines
Under Binding Operational Directive 22-01, Federal Civilian Executive Branch agencies are legally required to address these vulnerabilities by November 1st, 2026. This directive aims to reduce significant risks across government networks. While the mandate applies to federal entities, CISA strongly advises private sector organizations to prioritize these patches within their environments.
6Operational Impact and Uncertainty
Cisco has not disclosed specific details regarding the threat actors behind the active exploitation of their firewall software. Furthermore, the total number of targeted organizations and the extent of unauthorized access remain unconfirmed. This lack of visibility underscores the necessity for proactive security patching rather than waiting for specific breach indicators.
7Technical Mitigation Strategies
For GitLab users, the primary defense involves upgrading to versions 19.2.8, 19.3.5, or 19.4.2 to resolve the CI/CD configuration validation errors. Cisco administrators must verify their Secure Firewall ASA and FTD software versions against the vendor's security advisory. These updates are essential to close the identified entry points for remote attackers.
8Strategic Security Implications
The inclusion of these vulnerabilities in the KEV catalog serves as a critical signal for security teams to re-evaluate their patch management cycles. By focusing on flaws with confirmed exploitation, organizations can better allocate limited resources. Continuous monitoring of the CISA catalog remains a vital component of modern enterprise cybersecurity defense strategies.