CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on October 29, 2026, both due November 1: CVE-2026-76418, a crash bug in the SSL VPN service of Cisco Secure Firewall ASA and FTD, and CVE-2026-97229, a code-execution flaw in GitLab CE/EE. Cisco’s PSIRT says it became aware of active exploitation of its flaw in October 2026. We found no named threat actor or campaign for either bug as of October 30 in the Cisco advisory, the KEV entries, NVD, the GitLab release notes or the Ruby advisory.
The Cisco flaw
Cisco’s advisory (published October 28) describes logic errors in the Remote Access SSL VPN service. An unauthenticated remote attacker sends a crafted request and the device reloads. A successful VPN login is not required. A device is exposed when it runs an affected release, the SSL VPN login service is reachable, and a tunnel group, including the default DefaultWEBVPNGroup, uses secondary-authentication-server-group. Cisco says there is no workaround, but disabling secondary authentication (or the tunnel group list, where the default group does not use it) is a mitigation. First fixed releases include ASA 9.18.4.96, 9.20.4.50 and 9.22.3.200, and FTD 7.2.13, 7.4.9 and 7.6.7; the advisory lists every train.
The score of 8.6 is Cisco’s own; NVD had not published its own score as of October 30.
Not the first time
This is the second exploited reload bug in the same service within about 11 weeks. CVE-2026-20349, also scored 8.6 by Cisco, was listed in KEV on August 11 with a due date of August 14, and Cisco’s advisory for it says the PSIRT became aware of active exploitation in August 2026. Whether the same actors are behind both is not stated in any source we read.
The GitLab flaw
GitLab’s CNA record says an unauthenticated user could execute code on the server through a crafted regular expression in CI/CD configuration (integer overflow, CWE-190). Affected versions are 19.2.0 before 19.2.8, 19.3.0 before 19.3.5 and 19.4.0 before 19.4.2. GitLab scores it 10.0; NVD has no primary score. KEV carries the forensic triage flag for this entry. The KEV listing is our only exploitation evidence for GitLab; the 19.4.2 release notes, as we read them, do not state exploitation. Our severity label (high) is our judgement. A related flaw, CVE-2026-110264, was fixed on October 21 in later patch versions (19.4.3, 19.3.6, 19.2.9 and others), so patching to 19.4.2 alone is not enough.
What it means for the sectors
Our assessment, not drawn from a source we read: for communications providers and critical-infrastructure operators that use ASA/FTD for remote access, a reload takes that access down and could be repeated, so the repeat pattern is a resilience problem as much as a patching one. GitLab matters most where it holds pipeline credentials for network and OT software builds.
Recommended actions
- Check ASA/FTD for
webvpnandsecondary-authentication-server-group, including the default tunnel group, and upgrade to a fixed release. Cisco describes its mitigation as a temporary measure until upgrade, notes it lowers the security posture of remote access VPN in the default-group case, and says each customer must validate it in their own environment. - Upgrade GitLab to the latest patch of your branch, at least 19.4.3, 19.3.6 or 19.2.9, and review the instance for compromise.
- Under CISA’s BOD 26-04 the November 1 date applies to US federal agencies; our suggestion is that others treat it as the target.
- Our suggestion: check firewall logs for unexplained reloads since early October (Cisco says only “October 2026”; the earlier bug was exploited from August).