CISA gives agencies until 1 November for GitLab and Cisco ASA flaws

CISA gives agencies until 1 November for GitLab and Cisco ASA flaws

29 October 2026: The US Cybersecurity and Infrastructure Security Agency has added two flaws to its Known Exploited Vulnerabilities catalogue: CVE-2026-97229, which lets an unauthenticated user run code on a GitLab server through a crafted regular expression in a CI/CD configuration, and CVE-2026-76418, which lets a remote attacker reload Cisco Secure Firewall ASA and FTD devices. Both entries were added on 29 October with a due date of 1 November, three days later, for federal civilian agencies.

Not yet independently verified. CISA does not say who is exploiting either flaw or since when. The fixed versions listed here come from GitLab's, Ruby's and Cisco's own advisories as we reported them earlier, not from the catalogue. We will update this when it can be confirmed, and remove this note.

The GitLab flaw is in Ruby's regex engine

CISA classes CVE-2026-97229 as an integer overflow (CWE-190) in GitLab Community and Enterprise Edition and marks it for forensic triage, meaning agencies must look for signs of compromise as well as patch. Its note warns that "other products can potentially be affected by the same underlying Ruby/Onigmo Integer Overflow issue", pointing to Ruby's 23 October release. That is the point most often missed: GitLab 19.2.8, 19.3.5 and 19.4.2 carry the fix, but a self-built or distribution-packaged GitLab also needs Ruby 3.3.13, 3.4.12 or 4.0.9, as Alpine Linux found when it rebuilt its own GitLab. GitLab has since fixed a second flaw of the same family in 19.5.1.

Any Ruby application that compiles regular expressions supplied by users runs on the same engine, so the Ruby releases matter beyond GitLab.

The Cisco firewall reload

CVE-2026-76418 is an unchecked return value that leads to a NULL pointer dereference (CWE-690) in ASA and FTD software. An unauthenticated attacker can make the device reload, which drops VPN sessions and traffic through the firewall each time it is triggered. CISA does not require forensic triage for it. Cisco's advisory, cisco-sa-asaftd-tunnel-dos-s6mgkb75, lists fixed ASA and FTD releases for every supported train; we covered them when Cisco published the fix.

A tighter clock under BOD 26-04

Both entries cite BOD 26-04, CISA's directive on prioritising security updates by risk, rather than the older BOD 22-01, and its forensic triage requirements. The three-day window is far shorter than the two or three weeks most KEV entries get; the Linux kernel ESP flaw added a day earlier had three days too, while the VMware ESX and Adobe Commerce entries of 27 and 28 October have until 10 and 11 November. The deadline binds US federal civilian agencies only, but the catalogue is the list most private patch programmes rank by. CISA says ransomware use of either flaw is "unknown".

A team running GitLab should check both the GitLab version and the Ruby it runs on, then review CI/CD configuration changes and new runners since late October. Our DevOps software category lists 17 products and our source code management software category lists 17.

Company profile on TrustList: Cisco

Related on TrustList:

• Cisco fixes critical remote code flaws in Nexus switch software
• Cisco License On-Prem flaw lets anyone reset admin passwords

Sources

• CISA: Known Exploited Vulnerabilities Catalog (catalog version released 2026-10-29), 29 October 2026
• Ruby: Regexp fixes for GitLab CVEs, 23 October 2026
• heise online: Cisco-Firewalls und GitLab-Lücke werden angegriffen, 30 October 2026