GitLab Vulnerability Exploited: CISA Flags CVE-2026-97229 and a Cisco Firewall Flaw (CVE-2026-76418)
CISA says attackers are now exploiting a critical GitLab flaw and a Cisco ASA and FTD firewall bug. Here is what is confirmed, which versions fix them, and what to check this week.
Where Worldwide
On this page 8 sections
On Thursday, October 29, 2026, CISA added two flaws to its Known Exploited Vulnerabilities (KEV) catalog. One is a critical bug in self-managed GitLab and the other is a firewall-crashing bug in Cisco Secure Firewall ASA and FTD software. If your company runs its own GitLab server or uses a Cisco firewall for remote access VPN, deal with both this week. CISA only adds a flaw to the catalog when it has evidence that attackers are using it.
What CISA added to the KEV catalog
The CISA alert lists two entries:
- CVE-2026-97229: GitLab Community Edition and Enterprise Edition, an integer overflow or wraparound flaw.
- CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, an unchecked return value that leads to a NULL pointer dereference.
CISA says both were added "based on evidence of active exploitation." Its directive BOD 26-04 requires federal civilian agencies to fix them. CISA also encourages every other organization to put KEV-listed flaws at the top of its patch list.
What is confirmed and what is not
| Claim | Status |
|---|---|
| The GitLab flaw is being exploited | Confirmed by CISA's KEV listing. CISA has not said who is exploiting it or how. GitLab's October 12 release notes do not mention exploitation. |
| The GitLab flaw allows code execution without a login | Confirmed by GitLab, which says this works "under certain conditions". |
| The Cisco flaw is being exploited | Confirmed by Cisco: its security team became aware of active exploitation in October 2026. |
| The Cisco flaw lets attackers break into the network | Not what Cisco says. The advisory describes a denial of service: the firewall reloads unexpectedly. It does not mention data access or code execution. |
| Public exploit code exists for the GitLab flaw | Unconfirmed. News reports disagree, and we could not verify it. |
GitLab CVE-2026-97229: what it is and which versions fix it
GitLab published the fix on Monday, October 12, 2026, as a critical patch release. GitLab describes an integer overflow in the CI/CD regular expression compiler. Under certain conditions, an unauthenticated user could run arbitrary code on the GitLab server by putting a specially crafted regular expression into a CI/CD configuration. GitLab rates it 10.0 out of 10, the highest CVSS score.
Affected: GitLab CE and EE 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.
Fixed: 19.4.2, 19.3.5 and 19.2.8. Some forum posts and news articles list 19.3.4 instead. GitLab replaced 19.3.4 with 19.3.5 because 19.3.4 had a bug that broke merge request pages when the Ona integration was enabled, so go to 19.3.5 or later.
GitLab has since published newer patch releases: 19.5.3, 19.4.5, 19.3.7 and 19.2.10. Their main fix is a separate certificate trust issue (CVE-2026-111943). Upgrading to the latest patch on your version line covers both. GitLab warns that 19.5.3 and 19.4.5 include database migrations that cause downtime on single-node instances, so plan a short maintenance window.
GitLab.com and GitLab Dedicated: GitLab says GitLab.com already runs the patched version and Dedicated tenants were patched before the release. If you only use the hosted service, you do not need to upgrade anything.
GitLab also published six threat detections that let self-managed customers look for exploitation attempts against this flaw. You can find them through the October 12 release notes.
Cisco ASA and FTD CVE-2026-76418: what it does
Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 on Wednesday, October 28, 2026, and rated it High with a CVSS score of 8.6. A remote attacker who does not need to log in can make the firewall reload unexpectedly, which causes a denial of service. Cisco traces it to logic errors in the Remote Access SSL VPN service when secondary authentication is configured on a tunnel group.
Your firewall is exposed only if all three of these are true:
- The running configuration contains
webvpnand SSL VPN is enabled on at least one interface. - The SSL remote access VPN login page can be reached.
- Secondary authentication is configured on a tunnel group. That includes the built-in DefaultWEBVPNGroup.
Cisco says Cloud-delivered Firewall, Cloud-delivered Firewall Management Center, Secure Access and Secure Firewall Management Center software are not affected.
Cisco ASA and FTD fixed versions
| Product | Release line | First fixed release |
|---|---|---|
| ASA | 9.16 and earlier | 9.16.4.104 |
| ASA | 9.18 | 9.18.4.96 |
| ASA | 9.20 | 9.20.4.50 |
| ASA | 9.22 | 9.22.3.200 |
| ASA | 9.23 | 9.23.1.48 |
| ASA | 9.24 | 9.24.1.27 or 9.24.10.1 |
| FTD | 7.0 and earlier | 7.0.11 |
| FTD | 7.2 | 7.2.13 |
| FTD | 7.4 | 7.4.9 |
| FTD | 7.6 | 7.6.7 |
| FTD | 7.7 | 7.7.14 |
| FTD | 10.0 | 10.0.3 |
| FTD | 10.1 | 10.1.1 |
Cisco says there are no workarounds. It offers two temporary mitigations. If DefaultWEBVPNGroup does not use secondary authentication, run no tunnel-group-list enable in WebVPN configuration mode. Users will then need to know their connection profile name. If DefaultWEBVPNGroup does use secondary authentication, remove it with no secondary-authentication-server-group. Cisco notes that this weakens your VPN security. Test either change before you rely on it, and treat it only as a stopgap until you can upgrade.
How to check if you are affected: this week's checklist
| Task | How to check | Done when |
|---|---|---|
| Find every self-managed GitLab server | Look in Admin Area > Help, or run gitlab-rake gitlab:env:info on the server |
You have the version of every instance |
| Upgrade GitLab | Move to the latest patch on your line (19.5.3, 19.4.5, 19.3.7 or 19.2.10) | Version is at or above the fixed release |
| Review GitLab logs | Use GitLab's threat detections. Look for odd CI/CD pipeline activity since early October | No unexplained pipelines or jobs |
| Find every Cisco ASA or FTD device | On ASA, run show version. For FTD, check FMC or FDM |
You have the release of every device |
| Check VPN exposure | Look for webvpn and secondary-authentication-server-group in the running configuration, including DefaultWEBVPNGroup |
You know which devices meet all three conditions |
| Upgrade the firewall | Install the first fixed release (or later) from the table above | Device runs a fixed release |
| Review firewall logs | Look for unexpected reloads or crashes since October | Any reloads are explained |
If a GitLab server was exposed to the internet and unpatched for some time, a version upgrade alone does not prove nothing happened. Rotate the CI/CD variables, deploy keys and runner tokens stored on that server.
Why this matters for a business network
A self-hosted GitLab server holds more than source code. It usually stores the passwords, API keys and deploy credentials that push your website or app to production. Code execution on that server can give an attacker a path into everything it deploys to. For more on running your own servers safely, see our page on self-hosting infrastructure.
The Cisco flaw is a different kind of risk. It lets an attacker reload the firewall, so remote staff lose their VPN connection and anything that depends on the firewall goes offline until it comes back. If someone repeats the attack, it becomes a lasting outage. For a law firm, a medical office or a manufacturer with staff working remotely, that is a business continuity problem, even without any data theft.
GitLab and Cisco firewall vulnerability questions people are asking
Is CVE-2026-97229 being exploited?
Yes, according to CISA, which added it to the KEV catalog on October 29, 2026 based on evidence of active exploitation. CISA has not published details of the attacks.
Do I need to do anything if I use GitLab.com?
No. GitLab says GitLab.com and GitLab Dedicated are already patched. Only self-managed installations need an upgrade.
Is GitLab 19.3.4 safe?
GitLab's advisory lists 19.3 before 19.3.5 as affected, and 19.3.4 has a separate merge request bug. Upgrade to 19.3.5 or later, ideally 19.3.7.
Can CVE-2026-76418 let hackers into my network?
Cisco describes it as a denial of service that makes the firewall reload. The advisory does not say it allows access to data or code execution.
What is the CISA KEV catalog?
It is CISA's public list of vulnerabilities with evidence of real-world exploitation. If a product you run appears on it, that is a strong signal to patch first.
How do I check my Cisco ASA version?
Run show version on the ASA. For FTD, check the device in Firewall Management Center or Firewall Device Manager.
The bigger lesson
GitLab shipped its fix on October 12. CISA listed the flaw as exploited on October 29, seventeen days later. Any server that was still waiting for its next maintenance window during that gap was exposed. A patch only protects you once it is installed, and someone has to own that job. We covered this in Updated Is Not the Same as Patched and Who Is Patching the Software That Runs Your Business?.
Want someone to check your GitLab servers and firewalls? See security hardening or request a quote.
Get security alerts like this by email, plus our free checklist, at /security-alerts.
Sources: CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog; GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8; GitLab Patch Release: 19.5.3, 19.4.5, 19.3.7, 19.2.10; Cisco Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Malicious OpenClaw Skills: Acronis Found 575 Fake AI Agent Add-Ons Pushing Malware to Windows and Mac, and What to Check This Week
Acronis researchers found 575 malicious OpenClaw skills posing as useful AI agent add-ons. Confirmed payloads...
Refrigeration Controller Hacks: CISA and FBI Warn Cold-Chain Businesses, What Is Confirmed and the Danfoss Firmware to Check
US agencies say attackers are targeting refrigeration and cold-chain controllers after two waves of store atta...
Binance Hack: $6.3 Billion Taken After Engineers' Laptops Were Compromised, What Is Confirmed and What to Check This Week
Attackers took about $6.3 billion from Binance on October 29. Binance's preliminary findings trace the theft t...
