Firewalls and CI/CD servers are two of the most sensitive systems in any company. This week, both showed up on CISA’s list of vulnerabilities under active attack.
On October 29, CISA added two flaws to its Known Exploited Vulnerabilities catalog: CVE-2026-76418 in Cisco Secure Firewall ASA and Secure FTD software, and CVE-2026-97229 in GitLab Community Edition and Enterprise Edition.
The Cisco VPN bug
Cisco says CVE-2026-76418, rated 8.6 on the CVSS scale, lives in the Remote Access SSL VPN service. An unauthenticated, remote attacker can send a crafted request while connecting to the VPN and force the device to reload, causing a denial of service. According to The Hacker News, Cisco said the bug stems from logic errors when secondary authentication is configured on a tunnel group, and that a successful VPN login isn’t required to reach the affected code path.
Cisco became aware of exploitation in October 2026 but hasn’t shared who is behind it or how widespread it is. Devices are affected if they run a vulnerable release, have the SSL remote access VPN login reachable, and use secondary authentication at the tunnel group level. Fixes are available across ASA trains from 9.16 to 9.24 and FTD releases from 7.0 to 10.1. As a temporary workaround, Cisco suggests disabling secondary authentication where it’s configured, or turning off the tunnel group list in certain setups.
The GitLab bug
The GitLab flaw is more severe in impact. CISA describes CVE-2026-97229 as an integer overflow that could let an unauthenticated user execute arbitrary code on a GitLab server through a specially crafted regular expression in a CI/CD configuration. CISA notes other products may be affected by the same underlying Ruby/Onigmo regex issue and points to GitLab’s 19.4.2 patch release.
Federal agencies have until November 1 to address both flaws under BOD 26-04, and CISA flagged the GitLab entry as requiring forensic triage.
More Cisco news
Separately, Cisco Talos said an APT actor it tracks as UAT-11473 exploited an authentication bypass in Cisco SD-WAN Catalyst Controller, CVE-2026-20127, and deployed a custom malware framework called KeyDrift to steal keying material.
Why it matters
Edge devices and developer infrastructure keep getting hit because a single foothold there pays off big. Teams should patch now and review whether their VPN and GitLab instances need to be exposed to the internet at all.
For security vendors and MSSPs, back-to-back KEV deadlines create urgency inside IT departments. Reaching security and infrastructure leaders with practical help, like exposure assessments and patch support, lands better than generic outreach in weeks like this.
Sources: The Hacker News, CISA, CISA KEV Catalog. Written by the xRapid Media LLP team.
Selling to the IT market? xRapid Media LLP is a High Tech B2B Marketing company. We help technology companies reach decision-makers with verified B2B data, account-based campaigns, email and LinkedIn outreach and appointment setting. Call +91 9767196309 or book a free B2B marketing consultation.