The GitLab bug that scored a perfect 10 earlier this month is now being exploited in real attacks. On October 29 the US Cybersecurity and Infrastructure Security Agency added two flaws to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation: CVE-2026-97229 in GitLab and CVE-2026-76418 in Cisco's firewall software.
CISA did not say who is behind the attacks or how many organizations have been hit, and it does not publish that detail in KEV alerts. A listing does mean federal civilian agencies must prioritize the fix under Binding Operational Directive 26-04, and CISA urges every organization to do the same.
A GitLab server that runs a stranger's code
CVE-2026-97229 carries a CVSS score of 10.0, the maximum. According to its NVD entry, it affects GitLab Community and Enterprise Edition from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2, and under certain conditions lets an unauthenticated user execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration, because of insufficient regular expression validation.
A self-hosted GitLab instance typically holds an organization's source code and pipeline secrets, which is what makes server-side code execution there so valuable. We covered the fix in GitLab patches perfect-10 flaw letting strangers run code, and Rapid7's work turning it into a working exploit in Rapid7 turns GitLab's perfect-10 bug into working exploit. The KEV listing is the first official confirmation that attackers are now using it.
A Cisco firewall that can be forced to reboot
CVE-2026-76418, rated CVSS 8.6, affects Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. Its NVD entry describes an unchecked return value that leads to a NULL pointer dereference, which could allow an unauthenticated, remote attacker to make the device reload unexpectedly, a denial of service. The published record does not describe any code execution or data access, and CISA's alert adds no further detail. Cisco's own advisory carries the affected releases and fixed versions.
A firewall that reboots on demand still matters: while it reloads, the VPN and perimeter traffic it carries goes down with it.
Upgrade GitLab to 19.2.8, 19.3.5 or 19.4.2
- GitLab (CVSS 10.0): upgrade self-managed instances to 19.2.8, 19.3.5, 19.4.2 or later. Because exploitation is confirmed and the bug needs no login, also review CI/CD configurations and server logs for signs of activity before the patch was applied.
- Cisco ASA and FTD (CVSS 8.6): apply the fixed releases listed in Cisco's security advisory for CVE-2026-76418, and watch for unexpected device reloads.
BOD 26-04 also asks agencies to check whether a system was compromised before it was patched. For a GitLab server exposed to the internet during the last two weeks, that is good advice for anyone.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.