CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV

CISA has placed two newly exploited vulnerabilities on its Known Exploited Vulnerabilities catalog: a GitLab flaw and a Cisco firewall bug. CVE-2026-97229, rated a maximum CVSS of 10.0, is an integer overflow in GitLab Community and Enterprise Edition that lets an unauthenticated attacker run arbitrary code on the server through a malicious regular expression embedded in a CI/CD configuration. This issue is tied to a real-world attempt against Alpine Linux's own GitLab instance in late October, where an unknown actor sent crafted CI configs that crashed worker processes repeatedly and even pulled down the project's container image before being locked out; Alpine rebuilt the instance as a precaution even though no tampering was confirmed. The second entry, CVE-2026-76418 (CVSS 8.6), affects Cisco Secure Firewall ASA and FTD software, where an unchecked return value leads to a NULL pointer dereference, letting a remote unauthenticated attacker crash the device and trigger a denial-of-service outage; Cisco had already flagged active abuse of this bug earlier in October without naming the perpetrators or scope. Federal civilian agencies are required to apply the available fixes for both flaws by November 1, 2026.