CISA adds a critical GitLab flaw and a Cisco ASA/FTD vulnerability to its Known Exploited Vulnerabilities catalog

Two vulnerabilities, one in a Cisco firewall and one in the GitLab software development platform, were added on Thursday, October 29, 2026 to the Known Exploited Vulnerabilities (KEV) catalog of CISA, the US Cybersecurity and Infrastructure Security Agency. As the agency announced in its alert, the addition is based on evidence of active exploitation, meaning attackers are already using them. The deadline for US federal agencies is Sunday, November 1, 2026.

CVE-2026-76418: Cisco Secure Firewall ASA and FTD

CVE-2026-76418 affects Cisco Secure Firewall ASA and Cisco Secure Firewall Threat Defense (FTD). It is a return-value check flaw that ends in a NULL pointer dereference (CWE-690). According to Cisco, the problem lies in the remote-access SSL VPN service and stems from logic errors when secondary authentication is configured on a tunnel group. An attacker without credentials only needs to send a specially crafted request during VPN login to make the device reload unexpectedly. The result is denial of service: the firewall goes down and users lose access.

Cisco’s security advisory was published on October 28 with a “High” severity rating, and says its PSIRT team learned of active exploitation during October. Exposed are devices running a vulnerable version, with the SSL VPN login service reachable from the internet and secondary authentication on the tunnel group, even in the default DefaultWEBVPNGroup. There is no workaround short of upgrading, but there is a mitigation: disabling secondary authentication. Fixes include, for example, ASA 9.22.3.200 and FTD 7.6.7.

CVE-2026-97229: GitLab, rated 10.0

CVE-2026-97229 affects GitLab Community Edition and Enterprise Edition. It is an integer overflow, a calculation that exceeds the size memory can hold, in the regular-expression compiler of CI/CD, the automated testing and delivery system. With a specially crafted regular expression in a CI/CD configuration, an unauthenticated user can execute arbitrary code on the GitLab server. The company rates it critical and scores it 10.0 on the CVSS scale, which tops out at 10.

GitLab fixed the problem in its security release of Monday, October 12, 2026. Affected are versions from 19.2 up to before 19.2.8, from 19.3 up to before 19.3.5, and from 19.4 up to before 19.4.2. GitLab.com and GitLab Dedicated installations have already been updated, so the risk concerns those who run their own server. The root of the bug is in the Onigmo regular-expression engine of the Ruby language, and the Ruby team released versions 4.0.9, 3.4.12 and 3.3.13 with fixes on October 23. That is why CISA notes in the catalog that other products may be affected by the same problem.

The deadline and the directive

The deadline is set by Binding Operational Directive BOD 26-04, which asks US federal civilian agencies to prioritise the vulnerabilities carrying the greatest risk, especially on publicly exposed systems that hand over full control after exploitation. For GitLab the catalog also provides for forensic triage, an investigation for a possible breach before updating. CISA records the use of the two flaws in ransomware campaigns as unknown. It urges all organisations, not only federal ones, to prioritise the catalog’s vulnerabilities.

The addition fits the more proactive cyber defence described in the “CISA 2030” strategy.