Critical GitLab and Cisco Flaws Added to CISA KEV Catalog Demand Immediate Patch Action

Critical GitLab CE/EE Integer Overflow (CVE‑2026‑97229) & Cisco ASA Null‑Pointer DoS (CVE‑2026‑76418) Added to CISA KEV Catalog

What It Is — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has placed two high‑severity flaws into its Known Exploited Vulnerabilities (KEV) catalog.

• CVE‑2026‑97229 – An integer‑overflow/regular‑expression wraparound bug in GitLab Community and Enterprise Editions (versions 19.2 < 19.2.8, 19.3 < 19.3.5, 19.4 < 19.4.2). The flaw allows an unauthenticated attacker to execute arbitrary code on the GitLab server via a crafted CI/CD regex. CVSS = 10.0. GitLab has released patches for the affected releases.

• CVE‑2026‑76418 – An unchecked return‑value leading to a NULL‑pointer dereference in Cisco Secure Firewall ASA and FTD software. An unauthenticated remote actor can force a device reload, causing a denial‑of‑service condition. CVSS = 8.6. Cisco reports active exploitation and is issuing firmware updates.

Both vulnerabilities are being actively exploited in the wild; CISA’s Binding Operational Directive 22‑01 now requires federal agencies to remediate them by 1 Nov 2026, and it urges private organizations to do the same.

Affected Products – GitLab Community Edition & Enterprise Edition (19.2‑19.4 series) and Cisco Secure Firewall ASA / FTD software (all supported releases).

Why It Matters for Trust & Control Assurance – The additions test the vulnerability‑management control that requires continuous discovery, risk‑based prioritisation, and documented remediation – a single control that maps to many frameworks (e.g., NIST CSF Identify, ISO 27001 A.12.6, SOC 2 CC6).

Recommended Actions –

1. Run authenticated scans for the two CVEs across all GitLab and Cisco firewall assets.
2. Apply the vendor‑supplied patches (GitLab ≥ 19.2.8, 19.3.5, 19.4.2; Cisco ASA/FTD latest firmware).
3. Record remediation dates and evidence in your vulnerability‑management system to satisfy CISA BOD 22‑01 and audit requirements.
4. Update your control‑mapping repository to reflect the closed gaps.

Source: Security Affairs