The **CISA** on Thursday added two significant security vulnerabilities to its **KEV** catalog, citing evidence of active exploitation. These flaws impact widely used software from **Cisco** and **GitLab**, underscoring the persistent threat landscape faced by organizations. ### Critical GitLab Flaw: CVE-2026-97229 The first vulnerability, **CVE-2026-97229** (CVSS score: 10.0), is an integer overflow or wraparound flaw present in **GitLab Community Edition** and **Enterprise Edition**. This critical vulnerability could allow an unauthenticated attacker to execute arbitrary code on a **GitLab** server. The exploit leverages a specially crafted regular expression within a CI/CD configuration, bypassing insufficient regular expression validation. Evidence of exploitation for **CVE-2026-97229** emerged from a security incident disclosed by **Alpine Linux**. An unknown threat actor unsuccessfully attempted to exploit this flaw against an **Alpine Linux GitLab** instance on October 20 and 21, 2026. The attacker sent crafted CI configurations, causing **GitLab** worker processes to crash multiple times. While direct success was not confirmed, the attacker also downloaded **Alpine Linux**'s **GitLab** container image. Subsequent attempts on October 25 and 26 were blocked. **Alpine Linux** maintainers stated, "The attack came close to working. We have found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch. Our checks show that the aports repository, packages, and the October 21 releases were not tampered with." ### Cisco DoS Vulnerability: CVE-2026-76418 The second vulnerability, **CVE-2026-76418** (CVSS score: 8.6), affects **Cisco Secure Firewall Adaptive Security Appliance (ASA) Software** and **Secure Firewall Threat Defense (FTD) Software**. This is an unchecked return value to NULL pointer dereference vulnerability that an unauthenticated, remote attacker can exploit to trigger an unexpected device reload, resulting in a denial-of-service (**DoS**) condition. **Cisco** confirmed active exploitation of this vulnerability earlier this month. While the company has acknowledged the threat, it has not publicly disclosed details regarding the attackers, the number of targeted organizations, or the specific actions taken by adversaries after initial access. ### Urgent Call to Action Given the active exploitation of both **CVE-2026-97229** and **CVE-2026-76418**, **CISA** has mandated that Federal Civilian Executive Branch (**FCEB**) agencies apply the necessary patches by November 1, 2026. However, all organizations using affected **Cisco** and **GitLab** products are strongly advised to prioritize patching immediately to mitigate the risk of compromise and maintain operational continuity.