CISA Adds Two Known‑Exploited Vulnerabilities (CVE‑2026‑97229, CVE‑2026‑76418) to KEV Catalog
What It Is — The Cybersecurity and Infrastructure Security Agency (CISA) announced that two actively‑exploited flaws have been added to its Known Exploited Vulnerabilities (KEV) Catalog.
- CVE‑2026‑97229 – An integer‑overflow/wraparound issue in GitLab Community Edition and Enterprise Edition that can lead to arbitrary code execution.
- CVE‑2026‑76418 – An unchecked return‑value to NULL‑pointer dereference bug in Cisco Secure Firewall ASA and Cisco Secure FTD software, also enabling remote code execution.
Both CVEs have publicly disclosed evidence of exploitation and grant an attacker full control of the vulnerable asset. CISA’s Binding Operational Directive 26‑04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV‑listed flaws on publicly exposed systems and to verify whether compromise occurred before patching. While the directive is federal‑specific, CISA urges all organizations to adopt a risk‑based vulnerability‑management approach for these high‑impact bugs.
Affected Products
- GitLab Community Edition & Enterprise Edition (all supported versions)
- Cisco Secure Firewall ASA Software & Cisco Secure FTD Software (all supported versions)
Why It Matters for Trust & Control Assurance — The addition of these KEVs spotlights the control objective of effective vulnerability management and timely patch remediation, a single control that maps to many frameworks (e.g., NIST CSF 2.0, ISO 27001). Demonstrating disciplined patch prioritization provides defensible evidence for audit readiness.
Recommended Actions
- Inventory all public‑facing assets running the affected GitLab or Cisco Secure Firewall/FTD versions.
- Apply the vendor‑released patches immediately or implement mitigations (e.g., network segmentation, application‑level firewalls) where patching is not yet possible.
- Record remediation status in a centralized vulnerability‑management system and retain evidence for audit trails.
- Align remediation timelines with CISA BOD 26‑04 requirements and document any pre‑patch compromise checks.
Source: CISA Advisory – 2026‑10‑29