CVE-2026-76418 & CVE-2026-97229: Cisco and GitLab on KEV

CISA added two actively exploited flaws to its Known Exploited Vulnerabilities (KEV) catalog on October 29, 2026, and gave both the same due date: November 1, three days later. CVE-2026-76418 is a denial of service in the SSL VPN service of Cisco Secure Firewall ASA and FTD. CVE-2026-97229 is a critical remote code execution bug in GitLab CE and EE with a CVSS score of 10.0.

Technically they have little in common: one reloads a firewall, the other runs code on a CI server. What they share is that a quick version check can mislead you in both cases, because exposure depends on a configuration detail on the Cisco side and on the Ruby build underneath on the GitLab side.

CVE-2026-76418: Cisco ASA and FTD SSL VPN

Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 on October 28, 2026, rating it High with a CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) and CWE-690, an unchecked return value that leads to a NULL pointer dereference. An unauthenticated remote attacker can send a crafted request while connecting to the SSL remote access VPN and make the device reload. Cisco traces it to logic errors when secondary authentication is configured on a tunnel group. On FTD, a successful VPN login is not required to reach the affected code path.

Cisco says its PSIRT became aware of active exploitation in October 2026. It has not said when the attacks began, who is behind them, or how many organizations were hit. The flaw was found by Eric Fernald during a Cisco TAC support case.

A device is exposed only when all three of these hold:

It runs a vulnerable ASA or FTD release.
The SSL remote access VPN login service is enabled and reachable.
Secondary authentication is configured in a tunnel group.

Cisco says Cloud-delivered Firewall, cdFMC, Secure Access and Secure FMC Software are not affected. First fixed releases:

Product	Release train	First fixed release
Secure Firewall ASA	9.16 and earlier	9.16.4.104
Secure Firewall ASA	9.18	9.18.4.96
Secure Firewall ASA	9.20	9.20.4.50
Secure Firewall ASA	9.22	9.22.3.200
Secure Firewall ASA	9.23	9.23.1.48
Secure Firewall ASA	9.24	9.24.1.27 and 9.24.10.1
Secure Firewall FTD	7.0 and earlier	7.0.11
Secure Firewall FTD	7.2	7.2.13
Secure Firewall FTD	7.4	7.4.9
Secure Firewall FTD	7.6	7.6.7
Secure Firewall FTD	7.7	7.7.14
Secure Firewall FTD	10.0	10.0.3
Secure Firewall FTD	10.1	10.1.1

CVE-2026-97229: GitLab CI/CD regex compiler

GitLab released versions 19.4.2, 19.3.5 and 19.2.8 on October 12, 2026 as a critical patch release covering 24 CVEs. CVE-2026-97229 is an integer overflow in the CI/CD regular expression compiler, rated Critical with a CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and credited to joaxcar through HackerOne. Per GitLab, an unauthenticated user could, under certain conditions, execute arbitrary code on the server through a crafted regular expression in a CI/CD configuration. Affected are all versions from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. GitLab.com and GitLab Dedicated were already patched, and GitLab lists no workaround for self-managed installs.

The public evidence of exploitation comes from Alpine Linux, whose disclosure THN ties to the KEV addition. Alpine says that on October 20 and 21 a newly registered account sent crafted CI configurations to its GitLab instance, which was still on 19.3.4. The attack crashed GitLab worker processes eight times, and in four of those the attacker got partway through the exploit and failed at the next step. The attacker also downloaded Alpine's GitLab container image, which Alpine reads as tuning the exploit to its exact build. Further attempts on October 25 and 26 failed.

Alpine found no evidence that code ran on the server but could not rule it out, so it treated the instance as compromised, rebuilt it from scratch, reset passwords and replaced secret keys. It verified that its package repository and the October 21 releases were not tampered with.

A version check is not an exposure check

Both flaws have a trap that a version number alone does not reveal.

On the Cisco side, the vulnerable setting is secondary authentication in a tunnel group, and the group does not have to be one users see. Cisco's advisory says to check every tunnel group, including DefaultWEBVPNGroup, even for profiles not shown on the login page. Removing the tunnel group list does not remove exposure if the default group uses secondary authentication. On FTD the check happens in the deployed remote access VPN policy in FMC or FDM, not on the device banner.

On the GitLab side, Alpine's account shows a patch that did not patch. It upgraded to 19.3.4 on October 13 instead of 19.3.5 by mistake, and on October 22 moved to 19.3.6, which still did not fix the bug. Alpine's explanation is that the fix lives in Ruby, which GitLab applies only in its own packages, while Alpine's image used standard Ruby. The Ruby team's own notice says the underlying bugs are reached when an application compiles a regex from attacker-controlled input, and that a timeout or a pattern length limit does not reliably protect. Fixed Ruby releases are 4.0.9, 3.4.12 and 3.3.13.

That makes the three-day deadline harder than it sounds. An inventory that lists a firewall version or a GitLab version can show green while the exposed setting or the unpatched Ruby sits one layer below.

Reading it on VulnTracker

The two records show how little the exploitation signal depends on the score. CVE-2026-76418 is CVSS 3.1 8.6 High with EPSS at 0.6%, while CVE-2026-97229 is 10.0 Critical with EPSS at 18.4%, higher than 97% of all CVEs. Both show CISA KEV with the same dates: added October 29, 2026, due November 1, 2026. SSVC reads Active for both, with Partial impact on the Cisco record and Total impact on the GitLab one. NVD status is still Undergoing analysis for both.

The Cisco record lists two products from one vendor, Adaptive Security Appliance and Secure Firewall Threat Defense, with each affected release listed individually, and its remediation guide is empty. Take the fixed releases from Cisco's advisory above. The GitLab record shows the affected ranges as 19.2.0 up to but not including 19.2.8, 19.3.0 up to 19.3.5 and 19.4.0 up to 19.4.2, and it collects vendor advisories from Red Hat, SUSE and CERT-Bund. Remember that the ranges describe GitLab versions, not the Ruby build underneath.

What to do

Federal agencies must remediate by November 1, 2026. Everyone else can treat that as the target date.

Cisco ASA and FTD

Check exposure in the configuration, not only the version: SSL VPN enabled on an interface, and a secondary-authentication-server-group in any tunnel group, including DefaultWEBVPNGroup. On FTD, review the deployed remote access VPN policy in FMC or FDM.
Upgrade to the first fixed release for your train from the table above.
If you cannot upgrade yet, Cisco describes a temporary mitigation, tested in a lab only: disable secondary authentication on the affected tunnel groups. Cisco warns this can reduce functionality or lower the security posture of remote access VPN, so weigh it before applying.
Cisco publishes no indicators for this flaw, so unexplained reloads on VPN-facing firewalls since October are the thing to look at.

GitLab CE and EE

Upgrade self-managed instances to 19.4.2, 19.3.5, 19.2.8 or later.
If you build your own image or use a Ruby that is not GitLab's own package, confirm Ruby is 4.0.9, 3.4.12, 3.3.13 or later.
Review logs from October 13 onward using the six detections GitLab lists in its patch notes, and look for repeated worker crashes, 502 errors and failed CI jobs. Alpine notes that a successful exploit would leave no crash and no trace in web logs, so a quiet log does not prove safety.
For an instance that was reachable while unpatched, Alpine's response of rebuilding it, resetting passwords and replacing secret keys is the high end of what to consider.

Takeaway

Same catalog, same deadline, different traps. A Cisco VPN firewall is exposed by a setting that may sit in a tunnel group nobody looks at, and a GitLab instance can run a patched version number on an unpatched Ruby. Confirming the fix means checking the setting or the build, not only the version string.

To see which Cisco ASA, FTD and GitLab versions fall under these two CVEs, and to get alerted when your products land on KEV, track them on VulnTracker.