Ethical Hacking News
CISA Identifies and Warns of Two High-Severity Vulnerabilities in GitLab and Cisco Firewalls, two actively exploited vulnerabilities have been added to the Known Exploited Vulnerabilities (KEV) list. The identified vulnerabilities pose significant security risks to organizations that use the affected software, and the CISA has recommended that Federal Civilian Executive Branch (FCEB) agencies apply the fixes by November 1, 2026.
CISA has added two vulnerabilities (CVE-2026-97229 and CVE-2026-76418) to its Known Exploited Vulnerabilities list, posing significant security risks to organizations using GitLab and Cisco Firewalls. CVE-2026-97229 is an integer overflow vulnerability in GitLab, allowing arbitrary code execution via a specially crafted regular expression. CVE-2026-76418 is an unchecked return value vulnerability in Cisco Secure Firewall, allowing a denial-of-service (DoS) condition via an unauthenticated, remote attacker. The vulnerabilities have been actively exploited by attackers, with a threat actor attempting to exploit CVE-2026-97229 in October 2026. CISA recommends that Federal Civilian Executive Branch agencies apply the fixes by November 1, 2026, to protect against potential attacks. Organizations should stay up-to-date with security patches and regularly review and test their security configurations to prevent exploitation.
The Cybersecurity and Infrastructure Security Agency (CISA) has recently added two actively exploited vulnerabilities in GitLab and Cisco Firewalls to its Known Exploited Vulnerabilities (KEV) list. The identified vulnerabilities, designated as CVE-2026-97229 and CVE-2026-76418, have been found to pose significant security risks to organizations that use the affected software.
According to the CISA, CVE-2026-97229 is an integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise Edition. This vulnerability allows an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration due to insufficient regular expression validation. This flaw has a CVSS score of 10.0, indicating that it has a high severity level.
On the other hand, CVE-2026-76418 is an unchecked return value to NULL pointer dereference vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. This vulnerability could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial-of-service (DoS) condition. The CVSS score for this vulnerability is 8.6, indicating that it also has a high severity level.
The CISA has noted that both of these vulnerabilities have been actively exploited by attackers. In the case of CVE-2026-97229, a security incident was disclosed by Alpine Linux, in which an unknown threat actor unsuccessfully attempted to exploit the flaw targeting its instance on October 20 and 21, 2026. The attacker probed an unpatched GitLab instance by sending crafted CI configurations, causing the GitLab worker processes to crash eight times. In four of those crashes, the exploit failed at the next step. The threat actor also downloaded Alpine Linux's GitLab container image. Subsequent attempts by the attacker to get back in on October 25 and 26 were blocked.
The threat actor's attempts to exploit the vulnerability were thwarted by the maintainers of the security-focused Linux distribution, who treated the instance as compromised and rebuilt it from scratch. The maintainers' checks showed that the aports repository, packages, and the October 21 releases were not tampered with. It is worth noting that the threat actor's attack did not succeed, but the maintainers' actions demonstrated their diligence in maintaining the security of their system.
In light of the active exploitation of these vulnerabilities, the CISA has recommended that Federal Civilian Executive Branch (FCEB) agencies apply the fixes by November 1, 2026. This is an effort to protect organizations from potential attacks that could exploit these vulnerabilities.
The addition of these vulnerabilities to the KEV list serves as a reminder of the importance of staying up-to-date with the latest security patches and best practices. It also highlights the need for organizations to regularly review and test their security configurations to ensure that they are not inadvertently leaving themselves vulnerable to exploitation.
In conclusion, the CISA's identification and warning of the two high-severity vulnerabilities in GitLab and Cisco Firewalls is an important step in protecting organizations from potential attacks. By applying the recommended fixes and taking proactive steps to secure their systems, organizations can help prevent exploitation of these vulnerabilities.
Related Information:
https://www.ethicalhackingnews.com/articles/CISA-Identifies-and-Warns-of-Two-High-Severity-Vulnerabilities-in-GitLab-and-Cisco-Firewalls-ehn.shtml
https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html
https://nvd.nist.gov/vuln/detail/CVE-2026-97229
https://www.cvedetails.com/cve/CVE-2026-97229/
https://nvd.nist.gov/vuln/detail/CVE-2026-76418
https://www.cvedetails.com/cve/CVE-2026-76418/
Published: Fri Oct 30 03:50:07 2026 by llama3.2 3B Q4_K_M
