CISA Flags Actively Exploited Cisco Firewall & GitLab Flaws — Patch by Nov 1

What CISA added to the KEV list

CISA added two flaws on Thursday based on confirmed active exploitation. CVE-2026-97229 is a CVSS 10.0 integer overflow in GitLab Community Edition and Enterprise Edition that allows an unauthenticated attacker to execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration. CVE-2026-76418 is a CVSS 8.6 NULL pointer dereference in Cisco Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software that lets an unauthenticated, remote attacker crash the device and cause a denial-of-service condition.

Cisco says attackers are actively exploiting CVE-2026-76418 in the Remote Access SSL VPN service of ASA and FTD. In plain English: an attacker on the internet can reach your firewall's VPN login page and knock the firewall offline — taking remote workers, site-to-site tunnels, and in some cases your whole internet edge down with it.

Why this matters to a York County small business

Cisco ASA and FTD are workhorse firewalls in dentist offices, law firms, manufacturers, and medical practices across York County. If yours is exposed to the internet with SSL VPN enabled — which is the norm for any business that lets staff work remotely — it is in scope. CISA added CVE-2026-76418 to KEV on 29 October 2026, with a federal due date of 1 November 2026. That is a tight window, and the fact that CISA set it tells you exploitation is not theoretical.

The GitLab flaw is narrower but more dangerous where it hits. Any business running a self-hosted GitLab server — common in software shops, engineering firms, and anyone doing custom development — is exposed to full remote code execution. The addition to KEV relates to a security incident disclosed by Alpine Linux in which an unknown threat actor unsuccessfully attempted to exploit the flaw targeting its instance on October 20 and 21, 2026. The attack came close to working, the maintainers said.

What your IT provider should be doing this week

If you outsource IT, your provider should already be doing three things without being asked:

1. Inventorying every Cisco ASA/FTD appliance under management, checking firmware against Cisco's fixed releases for CVE-2026-76418, and scheduling emergency maintenance to patch before November 1. Cisco has not published indicators of compromise, attack signatures or attacker infrastructure for CVE-2026-76418 as of 30 October 2026, so patching is the only reliable defense.

2. Checking any self-hosted GitLab instance against the fixed versions. GitLab addressed the security issue in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8 and urged admins to patch their servers immediately.

3. Monitoring firewall logs for unexpected reloads or crash loops, and VPN authentication logs for abnormal probing. A reactive provider waits for a help-desk ticket; a proactive one — the kind of standard we hold ourselves to across York Computer's managed IT services — is already patching tonight. If you have an internal IT person juggling too many fires, this is exactly where co-managed IT support picks up the slack on after-hours patching and KEV response.

What York Businesses Should Do

York County businesses using Cisco ASA or FTD firewalls for remote VPN should confirm with their IT provider by Monday, November 3 that CVE-2026-76418 has been patched. If you self-host GitLab anywhere on your network, treat CVE-2026-97229 as a drop-everything patch.

Sources

• CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV
• CISA says max severity GitLab flaw now exploited in the wild
• Cisco Secure Firewall ASA and FTD CVE-2026-76418: Exploited SSL VPN DoS Flaw Added to CISA KEV
• CISA Confirms Active Exploitation of GitLab Vulnerability CVE-2026-97229