The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The flaws affect GitLab and Cisco software, with evidence of ongoing attacks.
The first vulnerability, CVE-2026-97229, is an integer overflow or wraparound flaw in GitLab Community and Enterprise Editions. It has a maximum severity score of 10.0 and allows unauthenticated attackers to execute arbitrary code on the server through specially crafted regular expressions in CI/CD configurations. The second flaw, CVE-2026-76418, impacts Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. This vulnerability, rated 8.6, can cause devices to reload unexpectedly, leading to denial-of-service conditions.
Cisco reported active exploitation of its flaw earlier this month but has not disclosed details about the attackers or their actions. Meanwhile, GitLab's vulnerability was linked to an attempted attack on Alpine Linux's unpatched instance on October 20 and 21, 2026. The attacker sent crafted CI configurations, causing GitLab worker processes to crash. Subsequent intrusion attempts on October 25 and 26 were blocked.
Alpine Linux maintainers noted that the attack nearly succeeded but found no evidence of actual compromise. They rebuilt their systems as a precaution. In response to these threats, federal agencies are urged to apply patches by November 1, 2026.