GitLab CVE-2026-97229 and Cisco ASA VPN Flaw Exploited: CISA Sets a 1 November Deadline

CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalogue on 29 October and gave US federal agencies until 1 November to fix both. One lets an unauthenticated attacker run code on self-managed GitLab servers; the other crashes Cisco firewalls running SSL VPN with secondary authentication.

Both have patches.

GitLab CVE-2026-97229

A crafted regular expression in a CI/CD configuration can let an unauthenticated user "execute arbitrary code on the GitLab server", and GitLab rates it CVSS 10.0. GitLab fixed it on 12 October: self-managed Community and Enterprise Edition servers need 19.4.2, 19.3.5 or 19.2.8, and anything on 19.2 to 19.4 below those is exposed. GitLab.com and GitLab Dedicated are already patched.

The flaw is an integer overflow in Ruby's Onigmo regex engine, and Ruby's maintainers recommend Ruby 4.0.9, 3.4.12 or 3.3.13 for other software built on it.

GitLab's advisory also carries detection rules for exploitation attempts. Run them on any server that sat unpatched after 12 October.

Cisco ASA and FTD CVE-2026-76418

An unauthenticated remote attacker can make a firewall reload, a flaw Cisco rates CVSS 8.6, and Cisco says it "became aware of active exploitation" in October 2026. A device is exposed only when SSL VPN is enabled on an interface and a tunnel group, including DefaultWEBVPNGroup, uses secondary authentication.

The fix is an upgrade to the first fixed releases: ASA 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48 or 9.24.1.27, and FTD 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 or 10.1.1. Until then, Cisco's suggested mitigation is to remove secondary authentication with no secondary-authentication-server-group or to disable the tunnel group list.

Also added on 28 October

The day before, CISA listed CVE-2026-46300, a Linux kernel bug first published in May, which it says can be chained with the PHP2Shell flaws "to implant PHP webshells and run commands as root"; the deadline is 31 October. Servers patched with the PHP2Shell check-and-patch guide still need their distribution's kernel update.