U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added GitLab and Cisco vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

Below are the flaws added to the catalog:

• CVE-2026-97229 (CVSS score of 10.0) GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound vulnerability
• CVE-2026-76418 (CVSS score of 8.6) Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

CVE-2026-97229 is a critical security flaw that could let attackers run code on its servers without logging in.

The flaw affects Community Edition (CE) and Enterprise Edition (EE), it is an integer overflow bug caused by weak validation of regular expressions in CI/CD configurations. The issue affects GitLab versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Users should upgrade to a patched version to protect their systems. GitLab advisory

“GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.” reads the advisory.

The researchers joaxcar reported this vulnerability through the company’s HackerOne bug bounty program.

Alpine Linux recently reported that an unknown attacker tried to exploit the vulnerability against Alpine Linux on October 20 and 21, 2026, but the attempts failed.

CVE-2026-76418 is a NULL pointer dereference vulnerability affecting Cisco Secure Firewall ASA and FTD Software. It could allow an unauthenticated remote attacker to force a device to reload, causing a denial-of-service (DoS) condition.

Cisco said it became aware of active exploitation earlier this month. The company has not disclosed who is behind the attacks, how many organizations have been targeted, or what attackers may have done after gaining access.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the two vulnerabilities by November 1st, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

Ruby security update 4.0.9, 3.4.12 and 3.3.13 fixes Onigmo regex bugs behind GitLab RCE flaws CVE-2026-110264 and CVE-2026-97229. Upgrade now.

Related Posts:

• Electrum Wallet Vulnerability Exploits RBF Fee Bumps
• Storybook Fixes CVSS 9.4 Dev Server Flaw That Lets Malicious Sites Inject Code
• Microsoft Ships Out-of-Band .NET Updates for Brotli Overflow and Linux Tarball Flaws

The post Ruby Fixes Onigmo Regex Bugs Behind Critical GitLab RCE Flaws appeared first on Daily CyberSecurity.

Technical details and PoC exploit code for CVE-2026-97229, a CVSS 10.0 GitLab RCE vulnerability exposing 25,766 hosts, are now public. Patch to 19.4.2 now.

Related Posts:

• Critical Nextcloud Collabora Online Flaw CVE-2026-110447 Actively Exploited in the Wild to Deploy Webshells
• Public PoC Exploit Code and Technical Details Disclosed for CVE-2026-74580 Linux vhost Vulnerability (Vghost)
• CERT/CC Warns of Critical CVE-2026-110005 OS Command Injection in Komodo Periphery Agent

The post Public PoC Exploit Disclosed for CVSS 10.0 GitLab Remote Code Execution Flaw CVE-2026-97229 Affecting 25,766 Hosts appeared first on Daily CyberSecurity.

GitLab fixed a critical vulnerability with a maximum CVSS score of 10.0 that could let unauthenticated attackers run code on its servers.

GitLab has addressed a critical security flaw, tracked as CVE-2026-97229 (CVSS score of 10.0), that could let attackers run code on its servers without logging in.

The flaw affects Community Edition (CE) and Enterprise Edition (EE), it is an integer overflow bug caused by weak validation of regular expressions in CI/CD configurations. The issue affects GitLab versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Users should upgrade to a patched version to protect their systems. GitLab advisory

“GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.” reads the advisory.

The researchers joaxcar reported this vulnerability through the company’s HackerOne bug bounty program.

The company also addressed these flaws:

• CVE-2026-92883 (CVSS score: 8.7) – A security flaw where an attacker can trick another user’s web browser into running malicious JavaScript code through a specially designed repository.
• CVE-2026-16301 (CVSS score: 8.5) – An authorization flaw that lets a user with a Developer role bypass security permissions and run automated testing/deployment (CI/CD) pipelines on protected code branches.
• CVE-2026-14814 (CVSS score: 8.2) – A pattern-matching flaw that allows an attacker to manipulate cached files, causing target users’ automated pipelines to run malicious code and potentially leak sensitive environment variables.

In early October, GitLab released patches for a critical vulnerability in its AI Gateway, tracked as CVE-2026-90970 (CVSS score of 9.9), that could allow an authenticated user with access to the Duo Agent Platform to execute arbitrary commands on the gateway.

GitLab disclosed the flaw on October 2 and fixed it with the release of AI Gateway versions 19.2.4, 19.3.2 and 19.4.1.

The issue affects the way the AI Gateway handles custom flow prompt templates. According to GitLab, a user with Duo Agent Platform access could use a specially crafted flow configuration to escape the prompt template sandbox and execute commands on the AI Gateway host.

“GitLab has remediated an issue in the GitLab AI Gateway that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, leading to arbitrary command execution on the AI Gateway.” reads the advisory.

The key point is that the attack does not require an unauthenticated connection. GitLab’s advisory does not provide further details about the exact conditions required to exploit the flaw or the permissions needed beyond that access.

GitLab credited the HackerOne researcher invisiblemeerkat with responsibly reporting the vulnerability.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CVE-2026-97229)

A GitLab critical vulnerability, CVE-2026-97229 (CVSS 10.0), allows unauthenticated arbitrary code execution. Upgrade to GitLab 19.4.2 now.

Related Posts:

• MariaDB Patches Nine Vulnerabilities Enabling Privilege Escalation and Code Execution
• NVIDIA DCGM Exporter Flaw CVE-2026-47483 Lets Attackers Crash GPU Monitoring
• AnyDesk RCE Vulnerability Details and PoC Exploit Code Publicly Disclosed

The post GitLab Patches CVE-2026-97229 (CVSS 10.0) Flaw That Lets Unauthenticated Attackers Execute Arbitrary Code appeared first on Daily CyberSecurity.