CISA says GitLab and Cisco ASA/FTD flaws exploited, adds two CVEs to KEV

What happened

On October 29, 2026, CISA said it had added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog “based on evidence of active exploitation” CISA. According to CISA, the two entries are:

• CVE-2026-97229: GitLab Community Edition and Enterprise Edition, an integer overflow or wraparound vulnerability.
• CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, an unchecked return value to NULL pointer dereference vulnerability.

CISA’s alert does not describe who is exploiting these flaws, how, or against which targets. These details are not confirmed. The CVE records available for this advisory (CVE-2026-97229 record, CVE-2026-76418 record) contained no further detail in the source data. Affected versions, fixed versions and the impact of each flaw are therefore not confirmed here.

CISA says Binding Operational Directive (BOD) 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically CVEs listed in the KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. CISA also encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities CISA.

Am I affected?

According to CISA, the products named are:

• GitLab Community Edition and Enterprise Edition.
• Cisco Secure Firewall ASA Software and Cisco Secure FTD Software.

Specific affected and fixed versions, and which deployment types are affected, are not confirmed in the sources. Check the GitLab and Cisco security advisories for these CVE IDs to see whether your version is affected.

What to do now

1. Inventory your GitLab CE/EE deployments and Cisco ASA/FTD devices, and note which are publicly exposed.
2. Look up CVE-2026-97229 and CVE-2026-76418 and the linked vendor advisories for affected versions and fixes.
3. Apply the vendor updates, starting with internet-facing systems.
4. CISA says BOD 26-04 establishes basic expectations for when agencies must check whether threat actors compromised a system before the patch was applied CISA. Review affected systems for signs of compromise in line with your own incident process.
5. US Federal Civilian Executive Branch agencies should follow BOD 26-04 requirements.

Sources

• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog
• CVE.org: CVE-2026-97229 record
• CVE.org: CVE-2026-76418 record