Two flaws, one deadline

The United States Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attackers are actively exploiting a maximum-severity GitLab vulnerability and a Cisco firewall flaw, and has ordered federal civilian agencies to fix them by Sunday 1 November 2026. The GitLab flaw, tracked as CVE-2026-97229, scores the maximum 10.0 for severity. It is an integer overflow weakness in the CI/CD regular expression compiler that could let an unauthenticated attacker run arbitrary code on a GitLab server through a specially crafted regular expression in a pipeline configuration. The Cisco flaw, CVE-2026-76418, scores 8.6 and can force a firewall to reload, cutting off VPN and network connections. This post covers the new CISA listing and deadline, not the earlier patch stories for each flaw.

Exploitation already seen

GitLab fixed the flaw in versions 19.4.2, 19.3.5 and 19.2.8 and has released threat detections for self-managed instances after detecting exploitation attempts. The addition to CISA's list follows an incident disclosed by Alpine Linux, in which an attacker probed an unpatched GitLab instance on 20 and 21 October, crashing worker processes eight times, before further attempts on 25 and 26 October were blocked. Cisco has separately said it learned in October that its firewall flaw was being exploited, although it has not identified the attackers or the number of organisations affected.

Why it matters beyond federal agencies

CISA's binding order applies only to US federal agencies, but the agency encouraged all organisations, including in the private sector, to treat the flaws as a priority. Internet watchdog Shadowserver tracks nearly 2,800 internet-exposed GitLab Community Edition instances, without saying how many have already been patched. Any organisation running an unpatched GitLab server or an affected Cisco ASA or Secure Firewall Threat Defense device with remote-access VPN should apply the fixed releases now and check for signs of compromise, rather than waiting for the deadline.

Sources: BleepingComputer | CISA Known Exploited Vulnerabilities Catalog