The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities affecting GitLab and Cisco products to its Known Exploited Vulnerabilities (KEV) catalog, confirming that both flaws are being actively exploited in the wild.
GitLab RCE Flaw
The more severe of the two issues is CVE-2026-97229, which carries a maximum CVSS score of 10.0. The vulnerability is described as an integer overflow or wraparound weakness affecting both GitLab Community Edition (CE) and Enterprise Edition (EE). Integer overflow flaws of this type can allow attackers to corrupt memory or bypass intended logic, potentially enabling remote code execution depending on how the flaw is triggered.
Cisco Firewall DoS Flaw
The second entry addresses a denial-of-service vulnerability in Cisco firewall software. While specific technical details on the Cisco flaw were not fully detailed in the available reporting, its inclusion in the KEV catalog confirms that threat actors have been observed exploiting it against real-world targets.
Why It Matters
Inclusion in CISA’s KEV catalog is reserved for vulnerabilities with confirmed evidence of active exploitation, distinguishing them from theoretical or unexploited bugs. Under Binding Operational Directive 22-01, U.S. federal civilian executive branch agencies are required to remediate KEV-listed vulnerabilities within a mandated timeframe, though the directive itself is a strong signal for private sector organizations as well.
Given the maximum severity score assigned to the GitLab flaw, organizations running self-managed GitLab CE or EE instances should treat patching as an urgent priority. Security teams responsible for Cisco firewall deployments should likewise confirm whether their software versions are affected and apply available fixes or mitigations.
Security professionals are advised to consult CISA’s KEV catalog directly and cross-reference their asset inventories to determine exposure, prioritizing internet-facing GitLab and Cisco deployments for immediate review.
