Source: The Hacker News
CISA has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation in the wild. The first is CVE-2026-97229, a maximum severity 10.0 integer overflow vulnerability in GitLab Community Edition and Enterprise Edition. An unauthenticated attacker can execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration, because the regular expression used in the CI/CD pipeline configuration is not properly validated. The second is CVE-2026-76418, an 8.6 severity unchecked return value to NULL pointer dereference flaw in Cisco Secure Firewall ASA and FTD software that lets an unauthenticated remote attacker reload the device and cause a denial of service.
A near miss that shows how real the threat is
The GitLab KEV entry relates to a security incident disclosed by Alpine Linux. An unknown threat actor probed an unpatched GitLab instance on 20 and 21 October 2026 by sending crafted CI configurations, which caused GitLab worker processes to crash eight times. Four of those crashes failed at the next step of the exploit, but the attack came close to working. The attacker also downloaded the Alpine Linux GitLab container image before later attempts on 25 and 26 October were blocked. The maintainers found no evidence of success but treated the instance as compromised and rebuilt it from scratch, confirming that the aports repository, packages and the 21 October releases were not tampered with.
Federal Civilian Executive Branch agencies have been told to apply the fixes by 1 November 2026, and every organisation running self managed GitLab should treat that date as its own deadline. If your GitLab instance drives CI/CD for production workloads, an unauthenticated RCE in the CI pipeline parser means a single crafted configuration file can become full server compromise, and from there access to source code, secrets and downstream deployment targets.
What to do now
Upgrade self managed GitLab CE and EE instances to the patched versions released in the October security releases, and treat any unexplained CI worker crashes in recent weeks as a potential exploitation signal. Combine the upgrade with a review of runner tokens, CI variables and deployment credentials, because patching closes the door but does nothing about an attacker who already walked through it. Do the same discipline for edge devices: the Cisco ASA and FTD flaw gives attackers an easy way to knock perimeter firewalls offline, so verify your firewall software versions and apply the available updates.
If you would like help auditing your GitLab and CI/CD pipeline security, or building a vulnerability management process that keeps pace with KEV deadlines, contact us for professional advice.