The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified two significant security vulnerabilities, one in Cisco software and another in GitLab, which are being actively exploited. These vulnerabilities are now part of CISA’s Known Exploited Vulnerabilities (KEV) catalog, which underscores the pressing nature of these threats.
Details of the Security Vulnerabilities
The vulnerability in GitLab, classified as CVE-2026-97229, holds a critical CVSS score of 10.0. This issue involves an integer overflow in both the Community and Enterprise editions of GitLab. It allows an unauthenticated attacker to execute arbitrary code on the server using a specially crafted regular expression in the CI/CD configuration. The flaw arises from inadequate validation of regular expressions.
CVE-2026-76418 affects Cisco’s Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Software, scoring 8.6 on the CVSS scale. This flaw is due to an unchecked return value leading to a NULL pointer dereference, which can be exploited by remote attackers to cause unexpected device reboots, resulting in a denial-of-service (DoS) condition.
Recent Exploit Attempts
Recently, Cisco acknowledged the active exploitation of the vulnerability in its software, although specifics about the attackers or the scope of the exploit remain undisclosed. Meanwhile, the GitLab issue came to light following an incident involving Alpine Linux, where an attempted exploitation was reported on October 20 and 21, 2026. The attackers targeted an unpatched GitLab instance, causing multiple crashes but ultimately failing to advance their exploit.
Further attempts by the same threat actor to compromise the system on October 25 and 26 were successfully thwarted. Alpine Linux has since taken measures to secure their systems by treating the instance as compromised and rebuilding it from scratch, ensuring their repositories and releases remained intact.
Urgent Security Recommendations
In response to these developments, CISA advises all Federal Civilian Executive Branch (FCEB) agencies to implement the necessary patches by November 1, 2026. This recommendation highlights the urgency of mitigating these vulnerabilities to prevent potential breaches.
The proactive approach taken by organizations like Alpine Linux serves as a reminder of the importance of vigilance in cybersecurity. As these vulnerabilities continue to be exploited, timely updates and patches are crucial to safeguarding sensitive information and maintaining the integrity of digital infrastructures.
