Science & Tech · Cybersecurity · 7 hrs ago
CISA flags actively exploited GitLab and Cisco firewall flaws
CISA added two actively exploited flaws to its catalog of known security vulnerabilities.
One affects GitLab, a platform used to manage software development and delivery.
The critical GitLab flaw can let attackers run code without logging in by using a specially crafted regular expression in a CI/CD configuration.
The other flaw affects Cisco Secure Firewall products and can force a firewall to restart, interrupting service.
Alpine Linux saw attacks on its GitLab system, found no evidence they succeeded, but treated the system as compromised and rebuilt it.
Patched versions are available, though some Alpine users need an updated container image that includes a Ruby fix.
US federal agencies must fix both flaws by November 1, 2026; CISA also recommends that private organizations address them.
CISA added actively exploited GitLab and Cisco firewall vulnerabilities to its Known Exploited Vulnerabilities catalog.
The GitLab flaw can allow unauthenticated attackers to execute code on affected servers and has a CVSS score of 10.0.
The Cisco flaw can let unauthenticated remote attackers trigger a firewall reload and denial of service; it has a CVSS score of 8.6.
CISA set November 1, 2026, as the deadline for federal agencies to fix both vulnerabilities.
Alpine Linux reported attempted exploitation of its GitLab instance on October 20 and 21, with no evidence of successful attacks.
- Who
- CISA added the flaws to its catalog; attackers have been exploiting them.
- What
- The flaws affect GitLab and Cisco Secure Firewall ASA and FTD software. They can enable code execution on GitLab or denial of service on Cisco devices.
- When
- CISA added the vulnerabilities by October 30, 2026; federal agencies must address them by November 1, 2026.
- Where
- The affected products are GitLab servers and Cisco Secure Firewall ASA and FTD devices. Alpine Linux reported attacks on its GitLab instance.
- Why
- CISA listed the flaws because they are being exploited, and federal agencies are required to address listed vulnerabilities to protect their networks.
This story does not have two clearly opposing sides.
GitLab published a patch release addressing the GitLab vulnerability.
Alpine Linux accidentally installed vulnerable GitLab version 19.3.4 instead of patched version 19.3.5.
Alpine Linux observed attacks on its GitLab instance but found no evidence of successful attacks.
Alpine Linux upgraded its GitLab instance to version 19.3.6, but the update did not include the Ruby patch needed to fix the flaw in its setup.
Alpine Linux published a container image containing Ruby 3.3.13, which addresses the vulnerability.
CISA’s additions of the GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog were reported.
- GitLab flaw
- CVE-2026-97229; CVSS 10.0
- Cisco flaw
- CVE-2026-76418; CVSS 8.6
- Affected GitLab versions
- 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2
- Cisco fix deadline
- November 1, 2026
- Alpine Linux attack observations
- October 20 and 21, 2026
3 sources
What people are saying
Cisco said it became aware of active exploitation earlier this month.
GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.