# CISA adds GitLab CE/EE (CVE-2026-97229) and Cisco ASA/FTD (CVE-2026-76418) flaws to KEV catalog

> CISA added two exploited vulnerabilities to the KEV catalog on 2026-10-29: CVE-2026-97229 (GitLab CE/EE, CVSS 10.0, unauthenticated code execution via a crafted regular expression in CI/CD configuration) and CVE-2026-76418 (Cisco Secure Firewall ASA/FTD, CVSS 8.6, unauthenticated remote DoS causing device reload). KEV due date for federal agencies is 2026-11-01.

- **Published:** 2026-10-30T21:15:23Z
- **Last reviewed:** 2026-10-30T21:15:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4857
- **ID:** TL-2026-4857
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-97229, CVE-2026-76418, CVE-2026-20349

## Description

CVE-2026-97229 is an integer overflow or wraparound (CWE-190) in GitLab's CI/CD Regular Expression Compiler, the component that parses, compiles and evaluates regular expressions in project pipeline configuration files. Insufficient regular expression validation lets an unauthenticated user execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration. GitLab scored it CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). It affects GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2 (BleepingComputer lists 19.3.4 as the 19.3 fix; GitLab's own release page states 19.3.5). It was reported by researcher 'joaxcar' through HackerOne and fixed in the 2026-10-12 patch release. GitLab.com was already patched and GitLab Dedicated is not affected. Per the source feed, Alpine Linux reported unsuccessful exploitation attempts on 2026-10-20/21. As of 2026-10-13 there were public exploit claims but no confirmed working PoC. GitLab states six threat-detection rules are available for self-managed instances.

CVE-2026-76418 affects Cisco Secure Firewall ASA Software and Secure Firewall Threat Defense (FTD) Software (hunt classification: unchecked return value leading to NULL pointer dereference). Cisco disclosed it on 2026-10-28 under advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 (bug ID CSCwx26625), CVSS 8.6. According to securityonline.info, logic errors when secondary authentication is configured on a tunnel group let an unauthenticated remote attacker send crafted requests that reload the device. Exposure requires the webvpn keyword enabled on at least one interface and secondary-authentication-server-group configured on a tunnel group or DefaultWEBVPNGroup. Cisco PSIRT confirmed exploitation in October 2026; attacker identity and targeting scope were not disclosed. Cisco lists no IOCs. Cisco's published mitigation is to disable secondary authentication (no secondary-authentication-server-group) or no tunnel-group-list enable. It was discovered by Eric Fernald during a Cisco TAC case.

Source discrepancy: Cisco's earlier ASA/FTD VPN DoS flaw CVE-2026-20349 (advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF, published 2026-08-11, exploited since August 2026, CVSS 8.6, CWE-244, no workarounds) has a similar impact but a different CVE, advisory and fixed releases. None of the fetched sources links the two, so they are treated as separate issues and CVE-2026-20349 is recorded only as related context. Likewise, the CISA KEV page text cites BOD 26-04 while the source feed cites BOD 22-01; both name a 2026-11-01 due date. No threat actor attribution, malware or network IOCs are stated for either vulnerability.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1499.004 Endpoint Denial of Service: Application or System Exploitation

## Sources

- [U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog](https://securityaffairs.com/202133/security/u-s-cisa-adds-gitlab-and-cisco-flaws-to-its-known-exploited-vulnerabilities-catalog.html)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [GitLab Patch Release: 19.4.2, 19.3.5, 19.2.8](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/)
- [BleepingComputer: GitLab warns of max severity code execution vulnerability](https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/)
- [SOCRadar: CVE-2026-97229 critical GitLab RCE](https://socradar.io/blog/cve-2026-97229-critical-gitlab-rce/)
- [Cisco Secure Firewall vulnerability exploited (SSL VPN) - CVE-2026-76418, cisco-sa-asaftd-tunnel-dos-s6mgkb75](https://securityonline.info/cisco-secure-firewall-vulnerability-exploited-ssl-vpn/)
- [Cisco Security Advisory: ASA/FTD Remote Access VPN DoS (CVE-2026-20349, related)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF)
- [BleepingComputer: Cisco warns of ASA and FTD VPN flaw exploited to crash devices (CVE-2026-20349, related)](https://bleepingcomputer.com/news/security/cisco-warns-of-asa-and-ftd-vpn-flaw-exploited-to-crash-devices)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4857