CISA KEV Alert: GitLab CVSS 10.0 RCE and Cisco ASA DoS Flaws Under Active Exploitation — What Cloud Security Teams Must Do Now
Executive Summary
In late October 2026, CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog following confirmed active exploitation. CVE-2026-97229, a CVSS 10.0 integer overflow in GitLab CE/EE, allowed unauthenticated remote code execution via malicious CI/CD configurations. An unknown threat actor targeted Alpine Linux's GitLab instance on October 20–21, crashing worker processes eight times before being blocked on October 25–26. CVE-2026-76418, a CVSS 8.6 null pointer dereference in Cisco ASA and FTD, enabled unauthenticated attackers to trigger denial-of-service reloads. FCEB agencies were given until November 1, 2026 to apply patches.
These incidents highlight the growing attack surface in DevSecOps toolchains and network security appliances. Supply-chain targeting of CI/CD platforms like GitLab is accelerating, and firewall DoS vulnerabilities are being weaponized to disable perimeter defenses before follow-on intrusion. Unpatched infrastructure remains the most reliable initial access vector for nation-state and financially motivated actors alike.
Why This Matters Now
CI/CD platforms are now primary attack targets because a single compromised pipeline can poison software releases across thousands of downstream users. Simultaneously, disabling firewall appliances via DoS clears the path for deeper network intrusion. With a November 1 patch deadline from CISA and CVSS 10.0 severity confirmed in the wild, organizations running unpatched GitLab or Cisco ASA/FTD instances face immediate, critical exposure.
Attack Path Analysis
An unknown threat actor targeted an unpatched GitLab instance by submitting specially crafted CI/CD configurations exploiting CVE-2026-97229 (CVSS 10.0), causing repeated worker process crashes and attempting arbitrary code execution on the GitLab server. In parallel, CVE-2026-76418 was actively exploited against Cisco ASA/FTD devices to trigger denial-of-service conditions, likely to disable perimeter defenses and facilitate further access. The attacker also downloaded the Alpine Linux GitLab container image, suggesting reconnaissance toward supply-chain compromise, though no confirmed post-exploitation success was established.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
The attacker submitted crafted CI/CD configuration payloads to an unpatched GitLab Community/Enterprise Edition instance exploiting CVE-2026-97229, an integer overflow vulnerability in regular expression validation (CVSS 10.0). This caused GitLab worker processes to crash eight times across October 20-21, 2026. Concurrently, CVE-2026-76418 was exploited against Cisco ASA/FTD devices via unauthenticated remote requests triggering NULL pointer dereference and device reload, degrading perimeter firewall availability.
Related CVEs
CVE-2026-97229
CVSS 10An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise Edition allows an unauthenticated remote attacker to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD pipeline configuration, due to insufficient regular expression validation in the CI/CD processing engine.
Affected Products:
GitLab GitLab Community Edition (CE) – < patched version as of October 2026
GitLab GitLab Enterprise Edition (EE) – < patched version as of October 2026
Exploit Status:
exploited in the wildReferences:
https://www.cisa.gov/known-exploited-vulnerabilities-cataloghttps://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-cataloghttps://thehackernews.com/2026/10/gitlab-patches-cvss-100-flaw-that-could.htmlhttps://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.htmlhttps://about.gitlab.com/releases/categories/releases/CVE-2026-76418
CVSS 8.6An unchecked return value leading to a NULL pointer dereference vulnerability in Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense (FTD) Software allows an unauthenticated remote attacker to cause the affected device to reload unexpectedly, resulting in a denial-of-service (DoS) condition.
Affected Products:
Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software – < patched version as of October 2026
Cisco Cisco Secure Firewall Threat Defense (FTD) Software – < patched version as of October 2026
Exploit Status:
exploited in the wildReferences:
https://www.cisa.gov/known-exploited-vulnerabilities-cataloghttps://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-cataloghttps://sec.cloudapps.cisco.com/security/center/publicationListing.xhttps://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Command and Scripting Interpreter
Software Deployment Tools
Supply Chain Compromise
Endpoint Denial of Service
Deploy Container
File and Directory Discovery
Obtain Capabilities: Vulnerabilities
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Flaw Remediation
Control ID: SI-2
CISA Zero Trust Maturity Model 2.0 – Application-Level Threat Visibility and Continuous Monitoring
Control ID: Application Pillar – Visibility & Analytics
NIS2 Directive – Vulnerability Handling and Patch Management
Control ID: Article 21 – Security of Network and Information Systems
DORA (Digital Operational Resilience Act) – ICT Vulnerability and Patch Management Obligations
Control ID: Article 9 – ICT Security Policies and Procedures
PCI DSS 4.0 – All System Components Protected from Known Vulnerabilities via Security Patches
Control ID: Requirement 6.3.3
ISO/IEC 27001:2022 – Management of Technical Vulnerabilities
Control ID: Annex A 8.8
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
GitLab CVE-2026-97229 (CVSS 10.0) exposes CI/CD pipelines to unauthenticated RCE via supply-chain attack vectors, threatening code integrity, lateral movement, and exfiltration across software development environments.
Information Technology/IT
Cisco ASA/FTD CVE-2026-76418 DoS vulnerability actively exploited in the wild dismantles perimeter firewall defenses, enabling uncontrolled east-west traffic and lateral movement across enterprise IT infrastructure.
Computer/Network Security
Active KEV-listed exploitation of both Cisco firewall and GitLab RCE flaws directly undermines security tooling, requiring immediate Zero Trust segmentation and egress policy enforcement to contain breach propagation.
Government Administration
CISA mandates FCEB agencies patch both vulnerabilities by November 1, 2026, citing active exploitation risks to government CI/CD pipelines and network perimeters under NIST.800-53 and ZTMM compliance frameworks.
Sources
- CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEVhttps://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.htmlVerified
- CISA Adds Two Known Exploited Vulnerabilities to Catalog - October 29, 2026https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalogVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- GitLab Patches CVSS 10.0 Flaw That Could Allow Remote Code Execution via CI/CDhttps://thehackernews.com/2026/10/gitlab-patches-cvss-100-flaw-that-could.htmlVerified
- Attacker Tried to Exploit Alpine Linux's GitLab Instance via CI/CD Misconfigurationhttps://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.htmlVerified
- Cisco Security Advisories - Secure Firewall ASA and FTD DoS Vulnerabilityhttps://sec.cloudapps.cisco.com/security/center/publicationListing.xVerified
- GitLab Security Releases and Advisorieshttps://about.gitlab.com/releases/categories/releases/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because the attacker relied on network reachability to exploit an unpatched GitLab instance, disable perimeter defenses, and attempt lateral pivot through CI/CD pipelines into downstream cloud workloads. Enforcing identity-aware segmentation and controlled egress policies would likely reduce the attacker's ability to move laterally, establish outbound channels, or exfiltrate build artifacts across cloud environments.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: A fabric-enforced perimeter around the GitLab workload would likely constrain inbound reachability, reducing the attack surface available to unauthenticated external actors attempting to submit malicious CI/CD payloads or probe for exploitable vulnerabilities in adjacent network devices.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the scope of privilege escalation by reducing what internal resources a compromised GitLab worker process could reach, limiting the attacker's ability to pivot from a process-level foothold into broader server infrastructure or CI runner environments.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely reduce the attacker's ability to pivot from a compromised GitLab environment into adjacent cloud workloads or internal build infrastructure, constraining lateral reachability even if an initial foothold were established within the CI/CD pipeline execution context.
Control: Multicloud Visibility & Control
Mitigation: Centralized multicloud visibility would likely surface anomalous outbound connection attempts from GitLab workloads to unrecognized external destinations, reducing the window during which an attacker could maintain a covert C2 channel before being detected and constrained by policy enforcement.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policy enforcement would likely constrain the attacker's ability to exfiltrate container images, build artifacts, or pipeline secrets to external destinations by limiting which outbound data paths are permitted from GitLab workloads, reducing the volume and scope of material that could leave the environment.
Had prior-stage controls reduced attacker reachability and lateral movement, the residual blast radius across the supply chain would likely be more contained, with downstream package consumers and build artifact recipients facing a lower probability of receiving tampered outputs originating from a fully compromised GitLab environment.
Impact at a Glance
Affected Business Functions
- CI/CD Pipeline Integrity and Software Supply Chain Security
- Network Perimeter Defense and Firewall Availability
- Source Code Repository and Package Distribution
- Federal Civilian Executive Branch (FCEB) IT Infrastructure Operations
Estimated downtime: 7 days
Estimated loss: N/A
The GitLab RCE vulnerability (CVE-2026-97229) posed a risk of unauthorized access to source code repositories, CI/CD pipeline configurations, secrets and credentials embedded in pipelines, and container images. In the Alpine Linux incident, the attacker downloaded a GitLab container image and caused repeated worker process crashes, though no confirmed tampering of the aports repository, packages, or October 21 releases was detected. The affected GitLab instance was rebuilt from scratch as a precautionary measure due to the inability to conclusively rule out compromise. The Cisco ASA/FTD vulnerability (CVE-2026-76418) exposed network infrastructure to availability loss through forced device reloads, potentially disrupting perimeter defenses and enabling secondary attack vectors during the outage window. FCEB agencies faced a mandated patch deadline of November 1, 2026, indicating significant urgency across government networks.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Inline IPS (Suricata-based) signatures covering CVE-2026-97229 exploit patterns and CVE-2026-76418 malformed request sequences to detect and block crafted CI/CD payloads and NULL pointer dereference attempts before they reach unpatched GitLab or Cisco ASA/FTD instances.
- • Enforce Zero Trust Segmentation and East-West Traffic Security controls to isolate GitLab servers and CI/CD runners from lateral reachability to internal workloads, preventing pipeline-injected credentials or container breakout from enabling cross-environment pivoting.
- • Apply Egress Security and Policy Enforcement (FQDN/URL filtering) on all GitLab server and CI runner egress paths to block unauthorized outbound connections to attacker-controlled infrastructure and prevent exfiltration of container images, source repositories, or pipeline secrets.
- • Leverage Multicloud Visibility and Control to baseline normal CI/CD traffic patterns and alert on anomalous behaviors such as repeated malformed CI configuration submissions, worker process crashes, or unexpected container image downloads indicative of active exploit probing.
- • Utilize Cloud Native Security Fabric (CNSF) inline enforcement across CI/CD pipeline entry points to apply real-time inspection of incoming configuration payloads, enabling distributed policy enforcement that can identify and terminate exploit attempts at the initial compromise stage before worker processes are destabilized.
