CISA Adds Actively Exploited GitLab and Cisco Flaws to KEV
Summary
CISA added Cisco and GitLab flaws to KEV, citing active exploitation. Alpine Linux said an attempt to exploit CVE-2026-97229 failed; later attempts were blocked. FCEB agencies were advised to apply fixes by November 1, 2026.
Key points
- CISA added two Cisco and GitLab vulnerabilities to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation.
- Cisco said it became aware of active exploitation earlier in the month; it has not disclosed the attackers, number of targets, or actions taken after initial access.
- Alpine Linux reported that an unknown actor attempted to exploit GitLab CVE-2026-97229 on October 20 and 21, 2026, by sending crafted CI configurations that crashed worker processes eight times.
- Alpine Linux said the exploit failed at the next step in four crashes. The actor also downloaded its GitLab container image; later access attempts on October 25 and 26 were blocked.
- Alpine Linux found no evidence of successful exploitation but could not rule it out, so it treated the instance as compromised and rebuilt it. It found no tampering in the aports repository, packages, or October 21 releases.
- FCEB agencies were recommended to apply the fixes by November 1, 2026.
Article Details
- Vulnerability Types
- Remote code execution
- Denial of service
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
CVE
Vendors
CiscoCybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation.GitLaband Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation.