Ethical Hacking News
U.S. CISA Adds GitLab and Cisco Flaws to its Known Exploited Vulnerabilities Catalog, Highlighting the Urgent Need for Remediation. The agency has added two critical vulnerabilities to its catalog, including a GitLab integer overflow bug and a Cisco NULL pointer dereference vulnerability, which pose a significant threat to the security of various systems and networks.
GitLab and Cisco have been identified as sources of critical security flaws. The two added vulnerabilities are CVE-2026-97229 and CVE-2026-76418, a critical security flaw and a NULL pointer dereference vulnerability. CVE-2026-97229 allows attackers to run code on GitLab servers without logging in. CVE-2026-76418 allows an unauthenticated remote attacker to force a Cisco device to reload, causing a denial-of-service (DoS) condition. CISA has ordered federal agencies to fix the two vulnerabilities by November 1st, 2026. Private organizations are recommended to review the KEV catalog and address the vulnerabilities in their infrastructure.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added two significant vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. GitLab and Cisco have been identified as the sources of these critical security flaws, which pose a substantial threat to the security of various systems and networks. This development underscores the importance of prompt remediation to prevent potential attacks and minimize the risk of data breaches.
The two added vulnerabilities, CVE-2026-97229 and CVE-2026-76418, have been identified as integer overflow bugs and a NULL pointer dereference vulnerability, respectively. The former, CVE-2026-97229, is a critical security flaw that could allow attackers to run code on the GitLab server without logging in. This vulnerability affects GitLab Community Edition and Enterprise Edition versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. It is essential for users to upgrade to a patched version to protect their systems from potential exploitation.
The latter, CVE-2026-76418, is a NULL pointer dereference vulnerability affecting Cisco Secure Firewall ASA and FTD Software. This vulnerability could allow an unauthenticated remote attacker to force a device to reload, causing a denial-of-service (DoS) condition. Cisco has not disclosed information about the number of organizations targeted or the potential actions taken by attackers who gained access.
The inclusion of these vulnerabilities in the KEV catalog highlights the urgent need for remediation and awareness among organizations and individuals. CISA has ordered federal agencies to fix the two vulnerabilities by November 1st, 2026, and experts recommend that private organizations review the catalog and address the vulnerabilities in their infrastructure.
The recent addition of these vulnerabilities to the KEV catalog serves as a reminder of the importance of staying informed and up-to-date on the latest security threats. It is crucial for organizations and individuals to prioritize remediation and take proactive measures to protect their systems and networks from potential attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/US-CISA-Adds-GitLab-and-Cisco-Flaws-to-its-Known-Exploited-Vulnerabilities-Catalog-Highlighting-the-Urgent-Need-for-Remediation-ehn.shtml
https://securityaffairs.com/202133/security/u-s-cisa-adds-gitlab-and-cisco-flaws-to-its-known-exploited-vulnerabilities-catalog.html
https://nvd.nist.gov/vuln/detail/CVE-2026-97229
https://www.cvedetails.com/cve/CVE-2026-97229/
https://nvd.nist.gov/vuln/detail/CVE-2026-76418
https://www.cvedetails.com/cve/CVE-2026-76418/
Published: Fri Oct 30 17:27:21 2026 by llama3.2 3B Q4_K_M
