Two flaws, one warning

The US Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws affecting Cisco and GitLab software to its Known Exploited Vulnerabilities catalogue, citing evidence of active exploitation. Federal civilian agencies are recommended to apply the fixes by 1 November 2026, an unusually short deadline that underlines how seriously CISA views the two bugs.

The first flaw, CVE-2026-97229, carries the maximum CVSS score of 10.0. It is an integer overflow in GitLab Community Edition and Enterprise Edition that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

The Cisco firewall flaw

The second flaw, CVE-2026-76418, scores 8.6 and affects Cisco Secure Firewall Adaptive Security Appliance software and Secure Firewall Threat Defense software. An unchecked return value leading to a null pointer dereference could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial-of-service condition.

Cisco said it became aware of active exploitation of the flaw earlier in October, and has not publicly identified the attackers, the number of targeted organisations, or what attackers did after gaining initial access. A separate analysis noted that one crafted request to the VPN login page of a vulnerable Cisco box can make the firewall reload, dropping every connection passing through it.

The GitLab incident behind the listing

The GitLab listing relates to a security incident disclosed by Alpine Linux, in which an unknown attacker unsuccessfully attempted to exploit the flaw against its instance on 20 and 21 October 2026. The attacker probed an unpatched GitLab instance by sending crafted CI configurations, causing GitLab worker processes to crash eight times, and further attempts on 25 and 26 October were blocked.

Organisations running either product should patch immediately and check for signs of exploitation, rather than waiting for the federal deadline. The two listings are a reminder that flaws in developer tooling and in network edge devices are among the most attractive targets for attackers, because both can open a path into much wider systems.

Sources: The Hacker News | CyberExperts