CISA Warns of Actively Exploited GitLab RCE and Cisco Firewall Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited vulnerabilities affecting GitLab and Cisco security appliances to its Known Exploited Vulnerabilities (KEV) catalog, escalating concerns over attacks targeting software development infrastructure and enterprise network defenses.
The vulnerabilities include a maximum-severity remote code execution flaw in GitLab Community Edition and Enterprise Edition, tracked as CVE-2026-97229, and a high-severity denial-of-service vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD), tracked as CVE-2026-76418.
Both flaws have been associated with real-world exploitation attempts. The GitLab vulnerability was targeted in an attack against the Alpine Linux project's infrastructure, while Cisco separately acknowledged active exploitation of its firewall vulnerability.
CISA added the flaws to its catalog on October 29, 2026, requiring affected U.S. Federal Civilian Executive Branch agencies to complete remediation by November 1.
The unusually short remediation window reflects the urgency of addressing vulnerabilities that attackers are already attempting to exploit. For private-sector organizations, the same disclosures provide a warning that critical development platforms and security appliances may become attractive targets even when they are not directly associated with sensitive customer-facing applications.
GitLab Vulnerability Carries Maximum CVSS Severity
CVE-2026-97229 is an integer overflow or wraparound vulnerability affecting GitLab Community Edition and Enterprise Edition.
The flaw received a CVSS severity score of 10.0, the highest possible rating, because it could allow an unauthenticated attacker to execute arbitrary code on a vulnerable GitLab server.
According to the vulnerability description, exploitation involves submitting a specially crafted regular expression through a CI/CD configuration. Insufficient validation of that expression can trigger the underlying integer overflow condition.
Integer overflows occur when arithmetic operations produce values that cannot be represented within the available numeric range. Depending on how the affected software handles the resulting value, the condition can lead to incorrect memory allocations, memory corruption, or other unintended behavior.
In this case, the vulnerability can potentially be exploited to execute attacker-controlled code within the GitLab server environment.
The security implications are particularly serious because GitLab is not merely a source code repository. Organizations frequently use it to coordinate software development, manage continuous integration and deployment pipelines, and maintain access to sensitive project information.
A compromised GitLab instance may therefore expose more than the underlying server.
Depending on its configuration and permissions, an attacker could potentially reach repository contents, automation credentials, deployment secrets, and other resources accessible to the affected application.
Those outcomes are possible consequences of compromising a privileged development platform, not confirmed results of the reported exploitation attempts.
The precise impact would depend on the privileges assigned to the GitLab service, the configuration of CI/CD runners, and the security controls protecting connected systems.
Alpine Linux Targeted Through Malicious CI/CD Configurations
The GitLab vulnerability attracted particular attention after the Alpine Linux project disclosed an attempted intrusion against its self-hosted GitLab infrastructure.
Alpine Linux is a lightweight, security-focused Linux distribution widely used in containers, embedded environments, and server deployments.
Its development infrastructure supports a significant open-source software ecosystem, making the integrity of its repositories and build processes especially important.
According to the project's maintainers, an unknown threat actor targeted an unpatched GitLab instance on October 20 and 21, 2026.
The attacker submitted specially crafted CI configurations designed to exploit CVE-2026-97229.
These attempts caused GitLab worker processes to crash eight times. In four instances, the exploit progressed far enough to encounter a failure at a subsequent stage.
The repeated crashes provided evidence that the malicious configurations were reaching vulnerable processing paths, although they did not establish that arbitrary code execution had succeeded.
The attacker also downloaded Alpine Linux's GitLab container image, apparently obtaining material that could be used to study the target environment.
Additional attempts to access the infrastructure on October 25 and 26 were blocked.
Alpine's maintainers stated that the attack came close to succeeding but that their investigation had not established a successful compromise.
Because they could not completely rule out unauthorized access, the team treated the GitLab instance as potentially compromised and rebuilt it from scratch.
This precautionary response illustrates the difference between failing to find evidence of compromise and establishing with certainty that no compromise occurred.
When attackers exploit memory corruption vulnerabilities, incomplete logs or interrupted processes may make it difficult to reconstruct every stage of an attempted intrusion.
Rebuilding affected infrastructure from a trusted state can therefore be appropriate when the integrity of a critical development system cannot be confidently established.
Alpine Reports No Evidence of Repository or Package Tampering
Following the attempted intrusion, Alpine Linux investigated whether its software development and distribution infrastructure had been altered.
The maintainers reported finding no evidence that the aports repository, distributed packages, or releases published on October 21 had been tampered with.
The aports repository is central to Alpine's package development process. Unauthorized modifications could potentially introduce malicious changes into software distributed to users.
The absence of detected tampering is therefore an important finding, particularly given the potential consequences of a compromise involving an open-source distribution's development infrastructure.
However, the maintainers' conclusions were limited to the evidence available during their investigation.
They did not claim to have proven that the attacker had never obtained any form of unauthorized access.
Instead, they took a precautionary approach by rebuilding the GitLab environment while verifying the integrity of relevant development artifacts.
The incident highlights why attacks against CI/CD platforms deserve special attention.
An attacker who compromises a development server may seek access to source code, build configurations, package signing infrastructure, or deployment credentials.
If such access is combined with insufficient controls over software release processes, the consequences can extend to downstream users who trust the affected project's software.
There is no public evidence that the Alpine Linux incident resulted in such a supply-chain compromise.
Nevertheless, the attempted exploitation demonstrates why development infrastructure should be treated as a high-value security asset.
Cisco Firewall Flaw Enables Remote Denial of Service
The second vulnerability added to CISA's KEV catalog affects Cisco Secure Firewall ASA and FTD software.
Tracked as CVE-2026-76418, the issue received a CVSS score of 8.6 and involves improper handling of an unchecked return value that can lead to a null pointer dereference.
A null pointer dereference occurs when software attempts to access memory through a reference that does not point to a valid object or memory location.
In the affected Cisco products, an unauthenticated remote attacker can exploit the vulnerability to cause the device to reload unexpectedly.
The resulting denial-of-service condition can interrupt firewall availability and disrupt network communications that depend on the affected appliance.
Unlike the GitLab vulnerability, the Cisco flaw is not described as enabling remote code execution.
Its principal documented impact is availability.
That distinction is important because a denial-of-service vulnerability can still create substantial operational consequences when it affects infrastructure responsible for protecting or connecting enterprise networks.
Firewalls frequently sit at critical network boundaries, supporting remote access, traffic inspection, and communications between business systems.
An unexpected reload may temporarily interrupt connections, disrupt VPN services, or interfere with applications that depend on the appliance.
The actual impact will depend on the deployment architecture, redundancy arrangements, and the services provided by the affected device.
Cisco acknowledged becoming aware of active exploitation earlier in October.
The company has not publicly identified the attackers, disclosed how many organizations were targeted, or established the broader objectives of the exploitation activity.
As a result, the available information supports the conclusion that the vulnerability is being exploited, but it does not establish a specific threat actor or campaign objective.
GitLab's Ruby Dependency Complicates Remediation
A particularly important detail emerged from Alpine Linux's investigation: upgrading GitLab did not necessarily remove the vulnerability.
The underlying defect affects Onigmo, the regular expression engine included in Ruby. GitLab uses Ruby to process regular expressions found in CI/CD configurations.
GitLab addressed the problem in its official Linux packages and container images by distributing a patched Ruby runtime. However, installations built from source or packaged with a separately maintained Ruby interpreter could remain vulnerable after upgrading GitLab itself.
Alpine encountered precisely this situation.
The project upgraded its GitLab server to version 19.3.6 on October 22, but its custom container image continued using an affected Ruby version. The team discovered the remaining exposure on October 26 and subsequently rebuilt the environment with a corrected runtime.
For organizations using self-compiled GitLab installations or custom container images, the distinction is critical.
Affected Ruby installations require a corrected version, including:
Ruby 3.3.13 or later in the 3.3 branch.
Ruby 3.4.12 or later in the 3.4 branch.
Ruby 4.0.9 or later in the 4.0 branch.
Ruby 3.2 has reached end of life and does not receive the corresponding upstream correction.
The incident demonstrates why vulnerability remediation must include dependencies rather than relying exclusively on the version number of the primary application.
A system can appear updated while retaining vulnerable components embedded in its runtime or container image.
CISA's KEV Addition Changes the Remediation Priority
CISA's Known Exploited Vulnerabilities catalog is intended to help organizations prioritize flaws for which credible evidence of exploitation exists.
Unlike a severity rating, which describes the potential technical impact of a vulnerability, inclusion in KEV indicates that exploitation has been observed.
The distinction is important because a critical vulnerability is not necessarily being exploited, while a lower-severity flaw may already be causing operational disruption.
In this case, CISA added both vulnerabilities following documented exploitation activity.
The agency established a November 1, 2026, remediation deadline for affected federal civilian agencies under its applicable vulnerability management requirements.
For other organizations, KEV inclusion does not create the same universal legal deadline, but it provides a strong reason to accelerate patching and exposure assessment.
GitLab administrators should determine whether their deployment uses GitLab's bundled Ruby runtime or an independently maintained installation.
Cisco administrators should examine whether their firewalls meet the specific conditions required for CVE-2026-76418, including exposure of the SSL remote access VPN login service and configuration of secondary authentication within relevant tunnel groups.
These details matter because remediation should reflect actual exposure rather than assuming that every installation is vulnerable in the same way.
Cisco Exploitation Depends on SSL VPN Configuration
Cisco's advisory provides additional context for the firewall vulnerability.
The flaw affects the Remote Access SSL VPN service when secondary authentication is configured for a tunnel group.
An attacker can send a specially crafted request during the SSL VPN connection process, causing the affected device to reload.
A successful VPN login is not required to reach the vulnerable processing path.
The issue therefore presents a risk to affected devices whose VPN login services are accessible to untrusted networks.
Cisco has released corrected ASA and FTD software versions across supported release branches.
For organizations unable to update immediately, Cisco has described configuration changes that may reduce exposure, including disabling secondary authentication in affected tunnel groups where operationally feasible.
However, modifying authentication settings can introduce separate security and operational consequences. Administrators should evaluate the impact carefully rather than weakening authentication controls without an alternative safeguard.
The preferred remediation remains deployment of the appropriate Cisco security update.
What Organizations Should Do Now
The simultaneous inclusion of GitLab and Cisco vulnerabilities in CISA's KEV catalog highlights the need to prioritize security weaknesses based on observed exploitation and the importance of affected systems.
Organizations should take the following actions:
Patch GitLab: Install the latest supported security release and verify that the Ruby runtime used by the deployment contains the necessary correction.
Inspect custom GitLab images: Review container build files, runtime dependencies, and package versions rather than relying solely on the GitLab application version.
Investigate exploitation attempts: Examine GitLab worker crashes, unusual CI/CD configurations, suspicious repository activity, and unexpected processes associated with the GitLab service account.
Review CI/CD secrets: If compromise is suspected, assess whether deployment credentials, runner tokens, and integration secrets may have been exposed.
Patch Cisco firewalls: Identify affected ASA and FTD appliances and deploy the appropriate fixed release.
Validate VPN configuration: Determine whether SSL VPN services and secondary authentication settings create exposure to CVE-2026-76418.
Monitor device availability: Investigate unexplained firewall reloads and service interruptions that could indicate attempted exploitation.
GitLab has also published detection guidance for suspicious CI lint requests, unusual regular expression processing, and crash patterns associated with the vulnerable runtime.
However, the absence of crashes does not prove that exploitation was unsuccessful. Alpine's investigation specifically noted that successful exploitation might leave fewer visible traces than failed attempts.
Where compromise cannot be ruled out, organizations should consider broader incident response measures, including credential rotation and rebuilding affected infrastructure from trusted images.
Two Vulnerabilities, Two Different Threats to Enterprise Operations
The GitLab and Cisco vulnerabilities illustrate different ways attackers can threaten essential technology infrastructure.
CVE-2026-97229 presents a potential remote code execution risk against a development platform that may hold valuable source code, automation credentials, and deployment capabilities.
CVE-2026-76418 threatens the availability of network security appliances that organizations depend on for remote access and traffic protection.
The Alpine Linux incident provides a particularly important warning about software supply-chain security. Although maintainers found no evidence that their repositories or packages were modified, the attempted intrusion targeted infrastructure closely connected to software development and distribution.
The case also demonstrates that an application update is not necessarily sufficient when the underlying vulnerable component is maintained separately.
For Cisco customers, the primary concern is operational resilience. Repeated exploitation of a firewall denial-of-service flaw could interrupt business connectivity even without providing attackers with administrative access to the device.
The common lesson is that vulnerabilities affecting trusted infrastructure deserve urgent attention once exploitation is confirmed, regardless of whether their immediate impact involves code execution or service disruption.
Organizations should use CISA's warning to reassess their exposure, validate the completeness of deployed patches, and investigate suspicious activity involving affected systems.
The priority is not merely to install a newer software version, but to establish that the vulnerable component has actually been corrected and that attackers have not already gained a foothold.
Sources: <Link url={turn973550view0.url.uri} title="The Hacker News — CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV"/>; <Link url={turn508331view0.url.uri} title="The Hacker News — Alpine Linux GitLab Exploitation Investigation"/>; <Link url={turn508331view1.url.uri} title="The Hacker News — Cisco ASA and FTD Security Advisory Coverage"/>. <Cite refs={["turn973550view0","turn508331view0","turn508331view1"]}/>