CISA adds exploited GitLab and Cisco vulnerabilities to KEV

CISA has added vulnerabilities affecting GitLab Community Edition, Enterprise Edition, and Cisco ASA and FTD firewall software to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of ongoing exploitation. TMGS recommends prioritizing affected systems for patching and reviewing suspicious activity.

Technical impact

CVE-2026-97229, rated CVSS 10.0, is an integer overflow or wraparound vulnerability in GitLab. Insufficient regular expression validation in CI/CD configuration can allow unauthenticated users to execute arbitrary code on the server.

According to NVD, affected versions are 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Alpine Linux reports that the fix involves a Ruby patch included in official GitLab packages. Updating GitLab alone is insufficient for installations built with a separate Ruby runtime. TMGS recommends checking that runtime and using Ruby 3.3.13, 3.4.12, 4.0.9 or later, as applicable.

CVE-2026-76418, rated CVSS 8.6, affects Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. An unchecked return value leads to a NULL pointer dereference, potentially allowing an unauthenticated remote attacker to trigger unexpected restarts and denial of service.

Alpine Linux incident findings

Alpine Linux reported that an unidentified actor attempted to exploit its unpatched GitLab system, causing worker crashes. Later attempts were blocked. Maintainers found no evidence of successful exploitation but could not rule it out, so they treated the system as compromised and rebuilt it. This incident does not confirm a successful intrusion into Alpine Linux.

TMGS defensive recommendations

• Inventory affected assets, prioritize Internet-accessible systems, apply fixes, and verify updates.
• Review GitLab worker crashes, unusual CI/CD configuration changes, and unplanned firewall restarts alongside other evidence before concluding that compromise occurred.
• Restrict management interfaces and review access permissions while patching proceeds.
• Preserve logs, verify recovery capabilities, and activate incident response when suspicious signs appear.

Read the full analysis on TMGS: https://tmgs.vn/tin-tuc/cisa-dua-lo-hong-gitlab-va-cisco-vao-kev-i.9572ee95-6c22-4262-b06b-93e2fc1174d9