CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog on October 29, each on evidence of active exploitation. CVE-2026-97229 is an integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise Edition. CVE-2026-76418 is an unchecked return value leading to a null pointer dereference in Cisco Secure Firewall Adaptive Security Appliance software and Cisco Secure Firewall Threat Defense software.
The pairing is awkward for defenders. GitLab sits inside the software supply chain, where a compromised instance can reach source code, credentials and build pipelines. Cisco firewall software sits at the perimeter, where exploitation can hand an attacker the network edge itself. CISA describes these vulnerability classes as a frequent attack vector posing significant risk to the federal enterprise.
Under Binding Operational Directive 26-04, federal civilian agencies must prioritise rapid remediation of catalog vulnerabilities on publicly exposed assets that grant total control after exploitation, and must check whether threat actors compromised a system before a patch was applied. CISA encourages all organisations to adopt the same risk based approach.
This is the third catalog addition covered here this week, after the October 27 Adobe and Brotli entries and the October 28 VMware ESX and Linux kernel entries. The pattern across the week runs from applications through virtualisation and kernels to, now, the firewall and the code repository, which is most of the enterprise stack in four days.