GitLab and Cisco Secure Firewall — Added to CISA KEV Catalog Following Active Exploitation of RCE and DoS Flaws (CVE-2026-97229 and CVE-2026-76418)

Publication date: October 30, 2026
Category: News / DevSecOps

Introduction

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog by incorporating two critical security flaws directly impacting software development pipelines and perimeter infrastructure worldwide. The vulnerabilities compromise GitLab’s DevOps lifecycle management platform and Cisco Secure Firewall perimeter security gateways. This action follows technical evidence confirming that both threat vectors are actively being weaponized by malicious actors in the wild, prompting federal civilian agencies to prioritize immediate remediation.

What is GitLab and Cisco Secure Firewall? (General Analysis)

Modern technological ecosystems depend heavily on centralized source code management and continuous integration (CI/CD) platforms, alongside network perimeter gateways capable of segmenting and safeguarding corporate assets.

  • GitLab (CE/EE): An end-to-end collaborative development platform that automates software building, testing, and deployment through CI/CD pipelines. Because it holds elevated execution privileges within infrastructure servers, compromising this platform grants full control over organizational source code and software artifacts.
  • Cisco Secure Firewall (ASA and FTD): Serves as the primary line of perimeter defense in enterprise architectures, managing secure remote access via Virtual Private Networks (SSL VPN) and filtering malicious traffic through deep packet inspection.

Confirmed Vulnerabilities Summary (Official NVD Data)

CVE Category (CWE) Impact CVSS Vector (summarized)
CVE-2026-97229 CWE-190 (Integer Overflow or Wraparound) Arbitrary Code Execution (RCE) 10.0 (Critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE-2026-76418 CWE-690 (Unchecked Return Value to NULL Pointer Dereference) Denial of Service (DoS) 8.6 (High) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

How Does It Work? (Technical Analysis)

Forensic analysis and incident reports shared by open-source maintainers, such as Alpine Linux, have allowed researchers to accurately map the mechanical execution of these attacks:

  • Attack Flow in GitLab (CVE-2026-97229): The flaw stems from insufficient regular expression validation within the CI/CD configuration subsystem in GitLab CE/EE (affecting versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2). An unauthenticated attacker can supply specially crafted CI configurations that trigger an integer overflow or wraparound (Integer Overflow or Wraparound), leading to arbitrary code execution at the operating system level on the GitLab server. In documented real-world incidents, threat actors probed exposed instances, causing worker processes to crash repeatedly and downloading container images, though prompt patching effectively contained the progression of the initial assault.
  • Attack Flow in Cisco ASA/FTD (CVE-2026-76418): The vulnerability originates from logic errors within the Remote Access SSL VPN service when secondary authentication is configured on a tunnel group. By failing to properly verify the return value of critical functions, a null pointer dereference condition is triggered. An unauthenticated remote attacker can transmit a crafted request during SSL remote access VPN connection establishment, causing the affected device to reload unexpectedly and resulting in a total denial-of-service (DoS) condition.

Affected Systems / Environments

The scope of these vulnerabilities spans a broad range of enterprise and institutional deployments:

  • GitLab Instances: GitLab Community Edition (CE) and Enterprise Edition (EE) versions within branches 19.2 (prior to 19.2.8), 19.3 (prior to 19.3.5), and 19.4 (prior to 19.4.2).
  • Cisco Devices: Hardware and virtual appliances running Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software with active Remote Access SSL VPN services and secondary tunnel group authentication configured.

Mitigation and Detection

Remediation

System administrators and infrastructure teams must apply security patches expeditiously:

  1. GitLab Upgrade: Immediately migrate affected instances to vendor-released patched versions (19.2.8, 19.3.5, 19.4.2, or later) where regular expression validation has been hardened.
  2. Cisco Upgrade: Apply the software updates provided in Cisco’s official security advisory to resolve the null pointer handling issue within the SSL VPN subsystem.
  3. Perimeter Restriction: While patches are deployed, restrict administrative and network access to GitLab interfaces and Cisco VPN portals using strict Access Control Lists (ACLs) and robust multi-factor authentication (MFA) at the network level.

Detection

Early detection of malicious regular expression probes within CI/CD pipelines and monitoring unexpected reboots on perimeter firewalls are critical indicators of ongoing exploitation attempts.

For incident response teams (Blue Teams), the following monitoring guidelines are recommended:

  • Analyze GitLab container execution logs for repetitive worker process crashes and anomalous HTTP requests linked to build configuration files.
  • Audit system event logs on Cisco ASA/FTD firewalls for software crash traces, memory dump artifacts, or unexpected reloads coinciding with incoming SSL VPN connections.

Wrapping Up

The addition of CVE-2026-97229 and CVE-2026-76418 to CISA’s KEV catalog underscores the urgency with which malicious actors are weaponizing complex logic flaws — ranging from flawed regex validation to improper memory pointer handling — to compromise software supply chains and destabilize network infrastructure. The rapid containment reported in recent real-world incidents highlights the critical importance of maintaining rigorous patch management policies and continuous perimeter visibility.

References