Security AffairsPierluigi Paganini
CISA adds GitLab and Cisco flaws to exploited vulnerabilities list
Part of the CVE-2026-97229 story · since 12 Oct
- Mon 12 Oct, 09:11 UTC. SecurityOnline, first report. Critical GitLab flaw lets unauthenticated attackers run code on servers. Cites a CVE in CISA KEV.
- Tue 13 Oct, 09:12 UTC. The Hacker News, its first report on the story. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code. Cites a CVE in CISA KEV.
- Tue 13 Oct, 12:50 UTC. Rapid7, its first report on the story. GitLab fixes critical flaw that lets attackers execute code via CI/CD regexes. Cites a CVE in CISA KEV.
- Tue 13 Oct, 13:28 UTC. SOCRadar, its first report on the story. GitLab rushes to patch critical flaw enabling unauthenticated server takeover. Cites a CVE in CISA KEV.
- Tue 13 Oct, 14:37 UTC. Security Affairs, its first report on the story. GitLab patches critical flaw letting attackers run code without logging in. Cites a CVE in CISA KEV.
- Wed 14 Oct, 11:01 UTC. SecurityOnline. Critical GitLab CI flaw enables unauthenticated remote code execution. Cites a CVE in CISA KEV.
- Fri 16 Oct, 15:37 UTC. Rapid7. GitLab fixes critical CI/CD flaw enabling unauthenticated remote code execution. Cites a CVE in CISA KEV.
- Mon 26 Oct, 03:21 UTC. SecurityOnline. Ruby fixes regex flaws that could enable GitLab server attacks. Cites a CVE in CISA KEV.
- Thu 29 Oct, 00:00 UTC. SecurityOnline. Attackers Target Alpine Linux GitLab With CVSS 10 RCE Flaw. Cites a CVE in CISA KEV.
- Thu 29 Oct, 12:01 UTC. The Hacker News. Attacker Targets Alpine Linux GitLab Server With CVE-2026-97229. Cites a CVE in CISA KEV.
- Thu 29 Oct, 20:00 UTC. CISA, its first report on the story. CISA Adds Actively Exploited GitLab Code Execution Flaw to KEV. Cites a CVE in CISA KEV.
- Fri 30 Oct, 08:30 UTC. The Hacker News. CISA Adds Exploited GitLab and Cisco Flaws to KEV. Cites a CVE in CISA KEV.
- Fri 30 Oct, 10:30 UTC. SecurityWeek, its first report on the story. Alpine Linux foils exploit attempt targeting GitLab vulnerability. Cites a CVE in CISA KEV.
- Fri 30 Oct, 21:30 UTC. Security Affairs. CISA adds GitLab and Cisco flaws to exploited vulnerabilities list. Cites a CVE in CISA KEV. This article, 14th of 14.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two flaws to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-97229 in GitLab Community Edition and Enterprise Edition, and CVE-2026-76418 affecting Cisco Secure Firewall ASA and Cisco Secure FTD. CVE-2026-97229 is described as a critical integer overflow/Wraparound vulnerability in GitLab’s CI/CD configurations, enabling an unauthenticated attacker to execute arbitrary code on servers.
The GitLab advisory notes affected versions as 19.2.x prior to 19.2.8, 19.3.x prior to 19.3.5, and 19.4.x prior to 19.4.2, with remediation via patched releases (19.2.8, 19.3.5, 19.4.2 respectively). Alpine Linux researchers reported attempted exploitation in late October 2026, though attempts were unsuccessful.
CVE-2026-76418 is a NULL pointer dereference vulnerability in Cisco Secure Firewall ASA and Cisco Secure FTD software that could allow an unauthenticated remote attacker to force a device reboot, causing a denial-of-service condition. Cisco stated that exploit activity was known earlier in October 2026, but the company did not disclose targets or attacker details.
Under Binding Directive 22-01 (Reducing the Significant Risk of KEV), federal agencies are required to address these vulnerabilities by the specified deadline, with CISA directing agencies to fix the flaws by 1 November 2026. The KEV catalog page also urges private organisations to review and remediate where applicable.
How the story developed
14 articles from 7 outlets since 12 Oct. Picked up again on 29 Oct after 3 days quiet. This was the 14th report, 19 days after the first.
- Mon 12 Oct, 09:11 UTC. SecurityOnline, first report. Critical GitLab flaw lets unauthenticated attackers run code on servers. Cites a CVE in CISA KEV.
- Tue 13 Oct, 09:12 UTC. The Hacker News, its first report on the story. GitLab Patches Critical Flaw That Could Let Attackers Run Server Code. Cites a CVE in CISA KEV.
- Tue 13 Oct, 12:50 UTC. Rapid7, its first report on the story. GitLab fixes critical flaw that lets attackers execute code via CI/CD regexes. Cites a CVE in CISA KEV.
- Tue 13 Oct, 13:28 UTC. SOCRadar, its first report on the story. GitLab rushes to patch critical flaw enabling unauthenticated server takeover. Cites a CVE in CISA KEV.
- Tue 13 Oct, 14:37 UTC. Security Affairs, its first report on the story. GitLab patches critical flaw letting attackers run code without logging in. Cites a CVE in CISA KEV.
- Wed 14 Oct, 11:01 UTC. SecurityOnline. Critical GitLab CI flaw enables unauthenticated remote code execution. Cites a CVE in CISA KEV.
- Fri 16 Oct, 15:37 UTC. Rapid7. GitLab fixes critical CI/CD flaw enabling unauthenticated remote code execution. Cites a CVE in CISA KEV.
- Mon 26 Oct, 03:21 UTC. SecurityOnline. Ruby fixes regex flaws that could enable GitLab server attacks. Cites a CVE in CISA KEV.
- Thu 29 Oct, 00:00 UTC. SecurityOnline. Attackers Target Alpine Linux GitLab With CVSS 10 RCE Flaw. Cites a CVE in CISA KEV.
- Thu 29 Oct, 12:01 UTC. The Hacker News. Attacker Targets Alpine Linux GitLab Server With CVE-2026-97229. Cites a CVE in CISA KEV.
- Thu 29 Oct, 20:00 UTC. CISA, its first report on the story. CISA Adds Actively Exploited GitLab Code Execution Flaw to KEV. Cites a CVE in CISA KEV.
- Fri 30 Oct, 08:30 UTC. The Hacker News. CISA Adds Exploited GitLab and Cisco Flaws to KEV. Cites a CVE in CISA KEV.
- Fri 30 Oct, 10:30 UTC. SecurityWeek, its first report on the story. Alpine Linux foils exploit attempt targeting GitLab vulnerability. Cites a CVE in CISA KEV.
- Fri 30 Oct, 21:30 UTC. Security Affairs. CISA adds GitLab and Cisco flaws to exploited vulnerabilities list. Cites a CVE in CISA KEV. This article, 14th of 14.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 14 articles as a listHide the list
- Mon 12 OctDay 01
- Critical GitLab flaw lets unauthenticated attackers run code on servers09:11 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
- Tue 13 OctDay 14
- GitLab Patches Critical Flaw That Could Let Attackers Run Server Code09:12 · The Hacker News · Known exploited CVE
- GitLab fixes critical flaw that lets attackers execute code via CI/CD regexes12:50 · Rapid7 · Known exploited CVE
- GitLab rushes to patch critical flaw enabling unauthenticated server takeover13:28 · SOCRadar · Known exploited CVE
- GitLab patches critical flaw letting attackers run code without logging in14:37 · Security Affairs · Known exploited CVE
- Wed 14 OctDay 21
- Critical GitLab CI flaw enables unauthenticated remote code execution11:01 · SecurityOnline · Known exploited CVE
Quiet for 2 days
Fri 16 OctDay 41- GitLab fixes critical CI/CD flaw enabling unauthenticated remote code execution15:37 · Rapid7 · Picked up again · Known exploited CVE
Quiet for 9 days
Mon 26 OctDay 141- Ruby fixes regex flaws that could enable GitLab server attacks03:21 · SecurityOnline · Picked up again · Known exploited CVE
Quiet for 3 days
Thu 29 OctDay 173- Attackers Target Alpine Linux GitLab With CVSS 10 RCE Flaw00:00 · SecurityOnline · Picked up again · Known exploited CVE
- Attacker Targets Alpine Linux GitLab Server With CVE-2026-9722912:01 · The Hacker News · Known exploited CVE
- CISA Adds Actively Exploited GitLab Code Execution Flaw to KEV20:00 · CISA · official · CISA alert · Known exploited CVE
- Fri 30 OctDay 183
- Alpine Linux foils exploit attempt targeting GitLab vulnerability10:30 · SecurityWeek · Known exploited CVE
- CISA adds GitLab and Cisco flaws to exploited vulnerabilities list21:30 · Security Affairs · Known exploited CVE · This article, 14th of 14